Die Hard 2. Or how not to hack airplanes

How could I criticise possibly the best action movie series of all time? Well, it’s to help dispel myths about hacking planes. TV shows and films help set a narrative that is hard to shift around aviation cyber, giving the travelling public a misleading view of their security when flying.

So let’s take a look at the story and clarify the record. To misquote John McClane “Yippee Ki-Yay Mother Hubbard!”

Probably the biggest issue is an operational one. If the planes couldn’t land at Dulles, they would automatically divert after a few minutes. Flight plans mandate an alternate airport just in case something is wrong at the primary destination – it happens from time to time. Fuel plans must allow for a diversion and 15 minutes holding time there. Reagan National airport is close by, though the runways are a little short for a heavy!

There are plenty of other airports within a safe flying time with long enough runways for any of the airplanes depicted in the movie.

Even if the ‘whole of the east coast’ was covered in the snow storm, it would have been known about before takeoff, with alternate airports outside the storm area planned in.

Where things do get interesting is the suggested tampering with the ILS or Instrument Landing System. How practical would this be?

In the movie, terrorists misconfigure the ILS to cause the planes to descend too low. That’s not really how an ILS works. There are two components of an ILS – the localiser and the glideslope. These are radio signals that are transmitted from ground antennas. The localiser defines the extender centerline of the runway, so pilots are aligned. The glideslope defines the angle of descent (usually 3 degrees)

There is a bit (well, a lot) of artistic licence taken; the weather is lousy with falling snow. This creates conditions that would require a Cat 3 autoland, where the airplane lands itself using the ILS and radio altimeter. However, making movies in Cat 3 conditions (effectively zero visibility) doesn’t make for creating action shots! Hence, there is reasonable visibility in the movie, enough to see the planes crash.

What we believe is proposed in the movie is that the glideslope is offset, bringing the planes in to land short of the runway. Changing the glideslope angle is one thing, changing the point at which the glideslope intersects the runway is most likely to require physically moving the antenna, which does not appear to be what was shown in the movie.

Indeed, there are a small number of ‘steep’ ILS approaches at greater than 3 degrees. London’s City airport’s ILS is at 5.5 degrees and was initially at 7.5 degrees.

The planes are shown to impact the ground as the ILS is apparently giving signals 200 feet lower. That would involve digging a hole 200 feet deep and somewhat longer to allow the ILS radio signals to reach the plane. That’s not what is shown in the movie!

It would be more effective to create a modified glideslope for a hilly approach path, with potential to cause controlled flight in to terrain. It would still be technically very challenging though.

How about another approach – broadcast a rogue ILS signal? This is possible and a couple of academic papers have been written on the subject. However, this would need an expensive and obvious antenna installed in the undershoot area of the runway. It would also require for the existing antenna to be deactivated, otherwise there is potential for conflicting ‘nav’ alerts to be received by the pilot.

So let’s say that a rogue signal could be broadcast. Could that bring the plane down?

Well, there are at other sources of data: Radio Altimeter (radalt), DME (distance measuring equipment), the barometric /pressure altimeter, and potentially GPWS (ground proximity warning system).

The radalt ‘comes alive’ at about 2,000 feet of altitude as it receives radio bounces from the ground below, a little like the pings in a submarine. Pilots will cross check their altitude during the approach to ensure that they are at the correct height for that phase of the approach. The radalt doesn’t work as effectively as a guide if there are hills under the approach, but Dulles is in a pretty flat area of the USA, so the radalt would be very useful.

DME, or distance measuring equipment, isn’t used so much for commercial airliners nowadays, with GPS use being far more widespread, but at the time of the movie, it was still in use. DME is a radio signal that shows the pilot how far they are from the airport (or other navigational beacon). Unless tampered with too, DME would have shown the wrong distance from the airfield if it was being properly monitored as part of the approach.

It’s not just the radio altimeter that gives altitude information. Pilots will also set their barometric altitude and should cross check on approach. Mis-setting this at the time would have required the wrong QNH (pressure setting) to have been provided to the pilots by radio.,

GPWS was less widespread at the time of the movie, but it provides audio alerts to the pilots in the event of a dangerous descent. That said, certain alerts will be disabled at certain phases of an approach, otherwise planes would never be able to land without ‘terrain’ and ‘pull up’ alerts distracting the pilots!

The future

Here’s the weird thing, the ‘hacks’ in Die Hard 2 are more plausible nowadays, amazingly.

ILS, DME and other navigational aids are expensive to maintain. They are increasingly being retired at smaller airports in favour of GPS approaches. GPS tampering is probably more possible than ILS height tampering.

But again, there are other sources of height data that one would expect a pilot to rely on. Broadcasting a tampered GPS signal to a plane in flight would also be a challenge – GPS receivers are on the top of the fuselage for obvious reasons, so the tampering would potentially need to come from ABOVE the victim plane. ATC also monitor approaches at many airports and will alert crews if their systems show the plane as being low on approach.

Another more effective method for tampering with height information would be for Col Stuart’s to have taken the ILS offline and forced planes to use a non-precision approach. That wouldn’t have worked in Cat 3 conditions, but taking control of the radio and giving incoming planes the wrong pressure setting could have resulted in the crash that they wanted to see. There’s an interesting case in point here, where a controller accidentally gave a plane the wrong QNH. There was no crash, but it was very close: https://simpleflying.com/paris-airbus-a320-wrong-pressure-reading/

Conclusion

It’s not easy to hack airplanes on approach. Die Hard 2 is full of technical aviation plot holes, but that’s not to say that we don’t love it as a movie.

Our only reservation is that it helps support a misleading narrative that planes can easily be hacked.