MH17: ?

, ! .


» MH17: ? »  DSB JIT »  DSB 13.10.15: MH17 Crash Appendices A-U


DSB 13.10.15: MH17 Crash Appendices A-U

151 177 177

151

150

APPENDIX U


FLYING OVER CONFLICT ZONES - RISK ASSESSMENT
Introduction
As established in section 7, operators assumed that Ukraine, as the airspace manager,
ensured the safety of air traffc. However, the countrys situation was rather complex;
major interests other than civil aviation also played a role, such as State security.
Moreover, Ukraine did not always possess a complete overview of what was playing out
in the conflict area. Other countries did not either. There may have been countries that
closely monitored developments in the area, but in doing so their focus was on
geopolitical and military-strategic aspects. Nobody seemed to realise that there was
busy traffc involving civil aeroplanes high above the area and that it was potentially at
risk. Consequently, other countries also failed to issue any warnings about potential
threats to civil air traffc.
Immediately after the crash of flight MH17, reports appeared in the media stating that
some operators had stopped flying over the eastern part of Ukraine prior to the crash,
while others continued to fly over the conflict area. Thus the suggestion was that the
operators that had stopped possessed more or better information about the armed
conflict and that this information could have or should have been shared with other
operators. There was also the idea that some authorities possessed threat-related
information that they could or should have shared.
Section 7 describes how, from mid April through 17 July 2014, virtually all operators that
flew over the eastern part of Ukraine, continued to do so. Some operators did stop
earlier, but with a few exceptions these had stopped before the conflict in the eastern
part of Ukraine started. In addition, in the period that the conflict expanded into the
airspace no state prohibited operators and airmen based in that state to fly over the
area, or explicitly warned of possible threats in the air as a result of the armed conflict.
The idea that crucial information was not shared with operators, does not appear to be
true. There must be another explanation for the fact that so many parties did not identify
the risk to civil aviation.
This explanation is that all parties adopted a selective focus. Ukraine, operators, other
states and international organisations acted from their own perspective, which meant
that the relevance of events that fell outside this immediate perspective was not
identifed. The consequence was that the emergence of a weak link (airspace
management) in the system of responsibilities did not result in other involved parties
taking action to help ensure civil aviation safety above the conflict area. No effective

152

151

safety net was in place. This raises questions about the organisation of the system of
responsibilities and current practice for assessing the risks that armed conflicts pose to
civil aviation.
This appendix describes how parties cooperate in the system, in collecting and assessing
risk information about conflict areas in relation to civil aviation. What differences can be
observed and what vulnerabilities characterise the risk assessment process? The Dutch
Safety Board aims to use this to lay the foundations for lessons that can be learned.
In this appendix, the Dutch Safety Board devotes attention to states as well as operators.
States play a major role in decision-making processes related to conflict areas because
they usually have more possibilities than operators for gathering intelligence. Operators
choose from the available flight routes. The investigation therefore focuses on the way in
which operators assess threats and risks related to their flight routes over conflict areas.
This naturally applies to situations in which the airspace is open and in which operators
are not subject to any flight bans imposed by their national authorities. For this part of
the investigation, data were obtained from thirteen operators and eight states. The data
have been made anonymous at the request of the parties, who cooperated voluntarily,
given that they were not parties involved in the crash of flight MH17.
In this appendix, the Dutch Safety Board uses the following illustrative categorisation of
the risk assessment process
https://d.radikal.ru/d22/1907/19/cd49b2ac7e7b.png
Figure 26: Steps in the risk assessment process. (Source: Dutch Safety Board)

Information gathering (and sharing): gathering information from diverse sources
related to a potential threat and sharing information with other parties (What could
happen? Are there intention and capability?)
Threat analysis: determining the probability of a threat occurring.
Risk analysis: estimating the risks to the operator, based on vulnerability and
consequences.
Decision-making: to fly or not to fly. If the decision is made to fly, are additional
measures necessary?
The various steps are not always strictly differentiated. However, there is a logical order:
information gathering about risks is performed prior to its assessment. Whether and
which parties gather information depends on how they interpret their responsibility.
Therefore, this appendix will frst address how states and operators interpret their
responsibilities.

153

152

States interpretation of their responsibilities related to risk assessment
This section describes what states - other than the state that manages the airspace - do
and can do to identify and manage risks posed by flying over conflict areas, while
retaining the sovereignty of the state that manages the airspace. In this respect, states
will frst focus on operators based in their own states. They can also share relevant
information with other states or operators. Operators decide whether or not to fly over
an area partly on the basis of information they receive from other parties. Parties such as
ICAO and EASA can play a role in providing (additional) information to the aviation
sector.
The states in which the operators are based can also play a role in the decision-making
related to flight routes, by providing information, recommendations or by restricting or
prohibiting overflights. ICAO regulations provide room to choose between these
respective roles. Despite the international character of civil aviation, national authorities
also differ in the way and the extent to which they manage potential risks to their
operators. This depends, for example, on how they view and interpret their responsibility
in relation to that of the operator. The following paragraph discusses these differences.
Differences between the guidance provided by states
Differences between states are characterised by two extremes. One extreme involves
States in which the authorities do not or virtually do not provide any guidance for the
operators; the other extreme involves states in which the authorities play a profoundly
regulatory role. In between there are states that go no further than (informally) providing
operators with information and countries that issue recommendations. Broadly speaking,
this results in four types of countries or practices. Obviously this is a simplifed
representation, but it illustrates which differences exist on an international level.

https://d.radikal.ru/d13/1907/33/b94796b5ab44.png
Figure 27: Differences between authorities in the degree of guidance they offer. (Source: Dutch Safety Board)

No or limited guidance from the authorities
In some of the countries examined, the national authorities generally do not interfere in
the selection of flight routes and flying over foreign conflict areas in particular, or strictly
limit any interference. This applies to Malaysia, for example, where the authorities focus
solely on domestic security, also with regard to aerodromes. Authorities in these countries
do not advise operators based in their countries or provide them with information about
flying over foreign conflict areas.

154

153

Information provision by the authorities
In some countries, including the Netherlands and Australia, the authorities can provide
operators with threat-related information to support their threat analysis, risk assessment
and decision-making processes. The way in which and the extent to which authorities
provide information in this practice differs from one country to another. It is possible for
a national authority to only provide operators with informal information, to support their
risk assessment and decision-making processes. Personal relationships and trust play a
major role in these types of informal contacts; in many cases it concerns information that
originates from the intelligence services, which must be protected. As a result, it is
possible that not all operators have access to the same information sources.
There are also countries that provide information to (national) operators on a formal
basis. In this case there is a formal procedure that regulates the provision of information
and the handling of confdential information.
Information is then provided via an offcially designated contact at a government service
(such as an account manager for civil aviation). The operators can also report any
information they may have to this contact.
The initiative involved in information exchange is generally taken by the operators in this
practice. In the event of a specifc threat, the authorities actively communicate the
situation to the operators.
Recommendations provided by the authorities
The investigation revealed that there are authorities that not only (informally) provide
their national operators with threat-related information, but also provide aviation-specifc
risk analyses or issue a recommendation based on this information. Some states, such as
France, take it a step further and issue formal (whether urgent or not) recommendations
and warnings, such as in the form of NOTAMs, about destinations and flight routes
outside its own airspace. The operators include this advice in their decision-making
process.

France
The French Pôle dAnalyse de Risques de lAviation Civile (PARAC), part of the
Direction Générale de lAviation Civile (DGAC), performs risk analyses to support
operators. The risk analyses are made available to the operators, on a need to know
basis. The authorities do not have the legal power to issue a flight prohibition related
to a specifc airspace. If the need arises, PARAC can issue a notifcation or NOTAM
to French operators, with a warning about flying to or over a specifc country or area.
In practice, an urgent recommendation has the same effect as a prohibition.

Regulation by the authorities
In a number of countries the authorities can prohibit operators based in that country
from flying to specifc destinations or from using (part of) foreign airspace. The state
concerned uses this option if the need arises, based on intelligence and its own threat

155

154

and risk analyses. In the United States, the Federal Aviation Administration (FAA) can
prohibit U.S. operators and airmen from flying over or to specifc areas, or impose altitude
restrictions for their operations in foreign airspace, using a NOTAM issued as an
emergency order of the FAA Administrator or an SFAR. Even prior to 17 July 2014, FAA
prohibitions/restrictions were in force in several conflict areas.102
The Department for Transport (DfT) in the United Kingdom can issue an overflight
prohibition based on the 1982 Aviation Security Act (see text box below). In 2015, for
instance, operators based in the United Kingdom were prohibited from using Libyan
airspace due to the potential risk to overflying air traffc from dedicated anti-aviation
weaponry.103 The Ministry focuses on developing risk analyses and potentially warning or
advising operators.
In Germany the state can impose a flight prohibition based on German Aviation law. This
occurred in July 2015 for the airspace of Yemen on the basis of the increased risk due to
military activities in the airspace over the country.104

The United Kingdom
The Department for Transport (DfT) receives intelligence and threat analyses from
the Joint Terrorism Analysis Centre (JTAC), which was set up in 2003 and in which
staff are employed from various intelligence organisations and government
departments JTAC gathers rough intelligence and uses it to identify trends and tries
to establish links with the aviation sector, before making the threat analyses available
to DfT. DfT translates the airspace threats identifed by JTAC into a risk analysis and
based upon this makes it advice available to all aviators UK air carriers as the basis
for their own risk assessments. If necessary, the DfT can take several steps, including
issuing NOTAMs to UK air operators, depending on the risk level identifed in an
area:
1. Low level risk. Warning: we want you to take this into account
2. Medium level risk. Advice: guidance to avoid, DfT strongly advises you not to
overfly
3. High level risk. Direction: you shall / will not fly

Four practices and differences in information gathering and analysis
States must possess information about conflict areas in order to compile a risk analysis
and warn or advise operators. In the countries examined, the authorities that provide


102 The director of the FAA has the legal authority, based on 49 US Code 40.113 (a) and 44.701 (a) (5), to restrict or
prohibit U.S. civil aviation in the airspace managed by other countries to combat the danger posed by conflicts or
other weapons-related dangers to U.S. civil aviation. The FAA can issue this type of flight prohibition as an
emergency measure on the grounds of 49 US Code 40113 (a) and 46.105 (c). NOTAMs including a flight prohibition
are, if necessary, followed by a SFAR specifying the flight prohibition. SFAR prohibition are also specifed in
OpSpec B050. The FAA can also use NOTAMs to issue flight recommendations to U.S. civil aviation to warn about
any danger posed by conflicts or other weapons-related dangers in the airspace managed by other countries.
103 NOTAM V0003/15.
104 http://www.bmvi.de/SharedDocs/DE/Artike … emen.html, consulted on 19 August 2015

156

155

more extensive guidance say that they use the information they receive from their own
intelligence services.105 In addition, these authorities, like operators, participate in
informal and formal networks with other national and foreign governments to exchange
and verify information.
In general, in situations in which national authorities inform or advise their operators
about flight routes or prohibit them from flying somewhere, they mutually exchange
information. During the information gathering and threat and risk analysis processes, the
authorities are in contact with the operators and the latter can ask questions and verify
information as well as provide information. One of the authorities involved, for example,
stated that it has also received threat-related information that operators have, in turn,
gathered through their stations in other countries.
Once threat-related information has been gathered, the threat analysis and subsequently
the risk analysis and decision-making processes take place. In some states, the authorities
that advise operators base their advice on threat-related information (analysis) from a
different government party and translate it into risk information for their registered
operators. In other states, in practice, the distinction between threat and risk analysis is
less strict and these processes are performed by a single body. The authorities concerned
say that they also examine the probability of the identifed threats. These authorities
then examine which measures are possible, such as in the form of an altitude restriction.106
Four practices and their implications
The differences identifed in the way in which states manage their responsibility related
to safe flight routes for their operators are important for learning lessons from the crash
of flight MH17. Especially the two most extreme practices involve disadvantages.
A state that adopts a detached role (practice 1) considerably reduces the chance of
operators in the state concerned being able to receive confdential information related
to the potential lack of safety along one of its flight routes. This increases the need for
those operators to actively gather relevant information, and not all operators have the
same resources for doing so. Moreover, operators have fewer possibilities than states for
gathering information about conflict areas.
States that are able to impose flight prohibitions on their operators (practice 4), offer an
additional barrier for limiting risks. They cause a shift in the distribution of responsibility
between the state and the operators based therein. When they actually impose a
prohibition, states deprive the operators of their ability to perform an independent risk
assessment and thus to fulfl their responsibility.


105 This information may however also involve conflict areas in general. It is also unknown whether the involved
intelligence services in these states actually examine threats to the aviation sector or whether this translation is
produced later on in the process by state bodies that process the intelligence to produce aviation-specifc
analyses.
106 The Dutch Safety Board does not know the extent to which authorities in these states proactively took upper
airspace into consideration in their risk analyses for civil aviation prior to the crash of flight MH17 and whether the
crash resulted in changes to information gathering, threat analysis and risk analysis processes.

157

156

Assessment of and decision-making related to risks
This section discusses risk assessment by states and operators and how they go about it.
First and foremost, this section describes how operators assess the risks posed by flying
over conflict areas. Risk factors are then derived from the characteristics of a number of
conflict areas. These can help clarify the risks involved in flying over such areas.
Steps in the assessment and decision-making process
To determine whether a flight can be executed safely, operators perform a risk
assessment. In their risk analysis and decision-making processes, operators examine the
safety of the flight route as a whole, from take-off to landing at the destination, including
the crews stopover at the location and the possibility and safety of any alternative routes
(see Figure 28). Security assessments are part of this process. For the differentiation
between risk assessment related to safety and security, respectively, see Table 15.
https://c.radikal.ru/c43/1907/a1/6e8c35766167.png
Figure 28: Different aspects that airlines take into account when determining a safe flight route. (Source: Dutch
                Safety Board)

The steps that operators follow to signal and assess potential threats are largely the
same. There may be differences. Many operators have a security department where
threat-related information is collected, analysed and interpreted. The security analysts
perform an advisory role in the decision-making process and concern themselves with
different security aspects related to flight operations. Annex 17 to the Chicago
Convention establishes that states must ensure that operators possess a written security
programme that complies with the requirements in the National Security Plan of the

158

157

relevant state.107 Annex 17 includes provisions for operators mainly related to security at
aerodromes or in the aircraft. The safety of flight routes through foreign airspace is not
part of the regulations. The safety of flying over countries can, as part of the flight, also
be the focus of a security department but this is not standard practice among all
operators.

Safety

Security

Accidents are limited to an acceptable level

Threats are limited to an acceptable level

Focus on human error or technical failure

Focus on acts of unlawful interference

Looking back (statistics)

Looking back and looking forward (+ new threats)

Worst case scenarios

(Probable) worst case scenarios

Large adjustability

Small adjustability

Focus on the ground and the air

Focus on the ground

Safety also incorporates security

Security enables safety

Table 15: Differentiation between risk assessment related to safety and security in aviation.

Information gathering
Firstly, to be able to perform a risk assessment it is important to possess relevant threatrelated information about a specifc area and the airspace concerned. Operators can use
diverse sources in this respect.
Aeronautical information
As previously mentioned, the formal provision of information by airspace managers
(authorities) to airspace users (operators) takes place through NOTAMs. However, it
turned out that NOTAMs rarely contain information about threats above conflict areas.
Other aviation organisations and authorities also provide information communication.
Media reports
Operators use media such as newspapers, magazines and television to identify potential
threats to their flight routes and destinations. Some operators also follow social media.
Various operators revealed that they subscribe to daily newsletters and regularly consult
databases to stay up-to-date about risks to the aviation sector and other developments
related to security throughout the world.108


107 Annex 17 to the Chicago Convention may afford states room for a broad interpretation in which risks to foreign
flight routes are also part of the National Security Plan, but the elaboration in the Aviation Security Manual
illustrates that such a broad interpretation is uncommon.
108 For an example see: http://ww1.jeppesen.com/company/alerts/alerts.jsp (consulted on 10 March 2015).

159

158

A geographical bias
Some operators in Asia revealed that media in their country reported very little
about the armed conflict in Ukraine (half a world away). Therefore, authorities and
operators paid little attention to the conflict. The use of the media as an important
source of public information could therefore also involve a geographical bias, in
which the risks of flying over conflict areas are not identifed.

Informal networks
Many operators do more than base their decisions on public information. These operators
also gather aviation-specifc, confdential or classifed threat-related information from
(informal) networks (Figure 29). This non-public information exists at various levels. A
rough distinction can be made between four groups of information suppliers in these
networks:
Operators eyes and ears on the ground, such as station managers and ground crew,
tour operators and operational staff on location.
Other operators. This involves a form of reciprocity: operators provide and receive
information.
Government parties (ministries, intelligence services, embassies, defence attachés).
Private service providers.

https://c.radikal.ru/c22/1907/78/f93082b82d3a.png
Figure 29: Informal networks. (Source: Dutch Safety Board)

160

159

Within these networks there are (partially) open as well as closed circuits in which the
parties exchange confdential or classifed information. One example of a closed circuit is
the network of operators within an airline group, which means a group of operators that
work together. These closed circuits are characterised by the fact that sources of received
intelligence are shared relatively freely. In (more) open circuits intelligence is shared, for
example, between alliance partners and code share partners (befriended operators)
and information sources will not be revealed or will be but to a limited extent. Both cases
involve reciprocity: operators in these networks provide and receive information.
There are operators that obtain non-public information in an informal manner via their
national authorities. Government parties with which these operators maintain contacts
include ministries, embassies, defence attachés and other military informants and
intelligence services. The extent to which operators obtain information from their
authorities varies from one country to another and from one operator to another. The
type of threat-related information the operators receive also differs. In one of the states
examined, an operator revealed that it regularly obtained formal and informal information
from the authorities. In other states, operators revealed that they had to request
information and verify it using their own network. In these cases, the contacts are often
informal and personal, unstructured and not institutionalised. One operator stated that it
received information from the intelligence services more often than other operators in
the same state due to a personal connection.
Sector-specifc analyses and (formal) recommendations from operators own authorities
As described before, there are also states in which operators form part of institutionalised
networks with their national authorities. In these states, the authorities collect and analyse
intelligence for operators related to foreign airspace and destinations, and provide
operators with additional, sector-specifc information, such as risk analyses. Operators in
these states also receive advice from their authorities.
Interpreting information
Operators may arrive at a different decision based on the same information. This indicates
that there are differences in the way operators interpret and weigh information.
Threat analyses
Threat analyses focus on determining the general threat level. There are differences in
how operators perform threat analyses, but several generic steps can be broadly
differentiated (see Figure 30). If information is found related to a possible threat to the
aviation sector, operator or involving a flight route or destination, this specifc information
is analysed systematically.

161

160

The general steps are:
1. A reference is created by examining political, economic and other relevant local
circumstances in a state.109
2. Research is conducted into whether there is capacity, or available means or skills to
intentionally cause damage, and whether there is an intention to intentionally cause
damage to the aviation sector or operator.
3. Information is verifed: what are open and closed sources saying and can the picture
of the threat be hitherto confrmed? In this respect, operators also consider the
decisions made by other operators: whether or not they are avoiding the state and if
they are, what are their reasons for doing so? 110
4. The threat level is determined: the extent to which the threat is found to be specifc,
credible and/or probable and whether measures are necessary to combat the threat.
In the event of a potential or specifc threat, the decision will be taken to perform a
more specifc risk analysis.


109 To this end the Fragile States Index, is often used, with information about current performances by states in
relation to numerous indicators, including political stability [state legitimacy] and factionalised elites, see http://
ffp.Statesindex.org/. Another database that various airlines consult is the risk map developed by the maritime
industry. This database provides information per state about risks in terms of politics, security, the risk of abduction
and risky waters (https://riskmap.controlrisks.com/).
110 In addition, an operator examines whether the other airline, which has decided to avoid the airspace, possesses
essential threat-related information. It may also be that the decision to opt for a detour is the result of a secondary
analysis; the state of registration can, for example, have a certain international risk profle, which means that
operators from this state are more likely to face security threats throughout the world. As a result, the decision
made by one operator does not invariably have implications for another airlines threat analysis.

162

161

https://b.radikal.ru/b26/1907/8b/ff8e51b0766b.png
Figure 30: Example of decision-making at an airline. (Source: Dutch Safety Board)

Risk analysis
The threat analysis serves as input for the risk analysis that follows. The risk analysis
translates the threats into risks facing the operator. These could be risks to the
organisation in general (such as the organisations objectives or reputation), as well as
more specifc risks to the continuity of commercial activities and the safety of people
and/or property. The risk analysis determines vulnerability and considers the
consequences of not taking mitigating action by the operator.
When studying the risks, the operator produces an estimate of the probability of an incident
occurring. Statistical data are leading when determining the probability of a particular
incident occurring: has the incident already occurred in the past, and if so, how often? By
examining historic series, the operator can estimate a scenarios statistical probability. It
weighs the probability against the potential impact, namely the expected severity and
scope of the damage. It does so using a risk matrix. Risk matrices may differ from one

163

162

operator to another, but generally have one axis representing an events impact on a scale
ranging from extremely low (no risk to safety, damage or injury is negligible, no action
necessary), to extremely high/catastrophic (safety not guaranteed, all safety nets failed,
irreparable major economic damage, fatalities), while the other axis represents the chance/
probability of it occurring, on a scale ranging e.g. from frequent to extremely unlikely or
from more than once a week to less than once a year. Below we provide an example.

https://b.radikal.ru/b16/1907/69/3bf0449d1c9c.png
Figure 31: Example of a risk index matrix. (Source: ICAO Safety Management Manual, Doc 9859)

The idea behind the matrix is that activities that involve an extreme risk may not be
undertaken. High and moderate risks require different types of mitigating (risk-reducing)
measures. Low and negligible risks can be accepted without any further measures.
For the risk facing civil aircraft above conflict areas, the severity of a related threat
(shooting down an aircraft) falls under the catastrophic category. This matrix illustrates
that, as soon as the probability increases from exceptional or unlikely to possible, the
risk category shifts from moderate (5D or 5E) to high (5C). This leads to a different risk
evaluation than that produced if a lower probability is involved. It is therefore important
that the chance of an event is determined as accurately as possible, and not solely in a
strictly quantitative manner. The next section will explain which improvements are
possible for conflict areas.
After the threat analysis there is usually an advice from the security department to those
persons at the operator who must make the decision (usually the Accountable Manager
in consultation with the Post Holders and sometimes supplemented with more
operational managers such as the Head of the Operations Control Centre).111 A decision
will eventually be taken based on this advice, such as the decision to avoid an area or to
continue to fly there, whether or not subject to specifc mitigating measures.


111 Some operators also refer to the role of insurance companies in the fnal decision: they can refuse to insure risky
flights.

164

163

Mitigating measures
A mitigating measure related to flying over a conflict area is, for example, the
obligation to have certain equipment on board (a Minimum Equipment List),
increasing the visibility of a civil aeroplane, additional instructions for pilots prior to
a flight or additional instructions for performing a possible emergency landing
above a conflict area.

Each operator performs its own risk assessment. Different factors can play a role when
assessing the identifed risks with regard to the flight route, such as the number of flights an
operator operates on a route (the more often you fly, the greater the risk that something
can happen to one of the aeroplanes, but also the greater the routes importance in
commercial terms), the relationship with the states to or over which an operator flies (an
operator from a state that is at war with another state runs a greater risk of being attacked)
and the nature of the armed factions (are they hostile to certain states, are they disciplined?).
An operators history of incidents can also play a role: if an operator has previously been
involved in an incident in or above a conflict area, it may be more inclined to avoid the
situation. Thus operators that possess the same threat-related information may, nevertheless,
come to a different conclusion, also with regard to flying over conflict areas.112
Factors related to conflict areas that increase risks
For conflict areas over which civil air traffc is still possible, it is important to obtain a picture
of the factors that could increase risks to civil air traffc flying over it. To this end the Dutch
Safety Board identifed, insofar as is possible, characteristics that could be relevant for
determining risks to civil aviation, for a number of conflict areas, including Ukraine.113
The conflicts that pose the greatest threat to civil aviation are those in which non-state
parties are involved. Such conflicts are characterised by a high degree of unpredictability.
It is diffcult to ascertain the weapons systems these parties possess. Furthermore, these
parties are not bound by international treaties and conventions and their intentions are
unclear with regard to parties not directly involved in the conflict.
The weapons systems that could pose a threat to civil aviation are primarily anti-air
missiles. MANPADS are present in most of these conflict areas, but their range is lower
than the altitude at which civil aeroplanes fly over the area. Insofar as can be determined,
medium or long-range surface-to-air missiles are not present in most of the conflict areas
described here. Conflicts in which major powers that do possess these weapons are
involved (behind the scenes), present a greater possibility that they will become available
than in other conflicts. Additionally, fghting factions seized these types of systems from
the states armed forces in several conflict areas. It is not known whether these factions
possess the knowledge and skill needed to actually use the systems seized, but it cannot
be ruled out that they are able to obtain the necessary knowledge and skill.


112 One example of this is a report in the media (Noordhollands Dagblad, 4 May 2015) that one Turkish Airlines flight
crosses conflict areas near Mosul and Tikrit in Iraq, while other airlines avoid Iraq and fly via Iran and Turkey.
113 It concerns the situation at the time the inventory was performed: July 2015. See section 6

165

164

In ICAO, the Working Group on Threat and Risk (WGTR) launched an initiative to assess
the criteria related to risks posed by conflict zones more effectively.114 The criteria are
intended for areas that are known, or can be assumed, to have anti-air missiles. Factors
that are of notable importance for determining the threat and risk of civil aircraft being
shot down are:
Civil aviation is the target of one of the fghting parties;
Those operating the anti-air missiles are (poorly) trained;
Flights involving military aircraft in a combat role are taking place;
Military transport flights are being operated;
Flight routes run through or close to locations of strategic importance, which can be
attacked from the air;
The absence of effective air traffc control above the area, such as because the state
in which the conflict is taking place does not exercise complete control of its territory.
According to ICAO, these factors increase the risk of flying over such a conflict zone. The
Dutch Safety Board believes that these criteria can be used to obtain a more effective
analysis of the risks posed by conflict areas to civil air traffc flying over them. The Dutch
Safety Board adds that the involvement of a major power in the conflict can increase the
chance of medium or long-range surface-to-air missiles being present, because these
types of systems cannot usually be acquired on the black market.
Applying these types of factors in a risk matrix, such as the example in Figure 31, could
result in a higher estimation of the probability of fghting parties shooting down a civil
aircraft intentionally or unintentionally, for some conflict areas. As the risk matrix
demonstrates, this estimated probability does not have to be much higher to produce a
different risk assessment.
Vulnerabilities involved in risk assessment
The crash of flight MH17 has raised questions in the aviation sector with regard to the
provision of information to operators related to flying over conflict areas. One of the
conclusions was that the sharing of available information about potential threats must be
improved, in the frst instance between states.115
The crash teaches us that simply sharing information may not be enough to prevent such
disasters. Information related to the expansion of the armed conflict into the air was
available, but none of the parties connected these developments to an increasing threat
to civil aviation. Since the upper airspace was not closed, operators assumed that it was
safe. They also made no connection between the conflict on the ground and risks to their
aircraft.


114 ICAO, HLSC15- WP/10, 7 January 2015.
115 ICAO High Level Meeting, August 2014

166

165

An effective risk assessment largely depends on the quality of the information and the
way in which parties interpret the information and assess risks. This section discusses the
vulnerability inherent to these processes. Vulnerabilities are: the fundamental principle
that flying is the standard, the varying and sometimes limited interpretation of their
responsibilities by states and operators, the dominant military perspective, the focus on
intention, the focus on the ground, operating from the perspective of destinations and
problems with sharing classifed and confdential information.

The importance of imagination
Past events also illustrate that, when signals indicating the existence of a threat can
be identifed using public information or gathered intelligence, it is still not easy to
actually view these signals and interpret them as a potential threat. The National
Commission on terrorist attacks upon the United States (9/11 Commission) reveals
that, in the event of the attacks of 11 September 2001, signals indicating an imminent
attack may have been present but that the authorities concerned did not interpret
them as such due to a lack of imagination (9/11 Commission 2004: 344 - 348).

By default, flights take place
The international civil aviation system is based on the assumption that, in principle, civil
air traffc is always possible: flying is the standard. States managing airspace shall impose
as few restrictions as possible. This system can provide an incentive to keep the airspace
open if potential dangers to air traffc are not yet entirely clear.
Flying is also the standard for operators. When it comes to new flight routes, they assess
whether they want to fly somewhere, whereas continuing to fly along existing routes over
conflict areas is a non-decision in most cases. The investigation revealed that operators
only reconsider existing routes for safety reasons if there are specifc indications of
danger. This largely determines how operators collect and interpret threat-related
information: they wait until an actual threat has been identifed. They use available
information to justify continuing to fly and to carry on doing exactly what they were
already doing.116 This perspective was observed with regard to flying over the eastern
part of Ukraine: the operators viewed the NOTAMs issued by Ukraine prior to 17 July 2014
as a signal that Ukraine was managing the airspace; not as an indicator for the worsening
safety situation in the airspace.
States and operators understanding of their responsibilities
The more a state or operator actively collects information about threats, the greater the
chance that it will identify threats that are not actively reported by a state that is involved.
There are operators that rely entirely on aeronautical information that is provided to


116 This is a general pattern of behaviour. Bazerman and Watkins (2004:7) refer to the human tendency to maintain the
status quo: When a system still functions and there is no crisis to catalyse action, we will keep doing things the
way we have always done them.

167

166

them, without seeking additional information about potential threats to the airspace. In
doing so they are not contravening any ICAO provisions; Annex 17 does not stipulate any
explicit measures for preventing threats in the (upper) airspace.
Operators that rely solely on aeronautical information and do not gather any additional
information, are acting in accordance with the basic principle of the sovereign state,
which manages the airspace and provides users of its airspace with adequate information.
In doing so they make themselves highly dependent on other parties. In the frst place,
that is the state responsible for managing the airspace. However, in a state in which there
is an armed conflict with another state or between domestic parties, it is possible that
the safety of civil airspace is not accorded the highest priority. Moreover, it is not always
clear whether the state exercises full control over its territory. In the existing aviation
system, there are few formal possibilities for helping a state, which fnds itself in these
circumstances, to ensure the safety of the airspace for civil air traffc, because the state
could view this as a violation of its sovereignty.
A possible additional guarantee in the existing system is that operators gather
supplementary information about the risks to the airspace above a conflict area. As
mentioned, there are clear differences in the extent to which operators do so. The
differences arise, for example, from the decisions operators make in their security
management. The size of the operator is not always decisive, as there appear to be
differences between operators of a similar size.
To collect information about conflict areas operators can use public sources, but are
partly dependent on information they receive from their national authorities. It generally
concerns information from intelligence sources, and this type of information is preeminently gathered by a states. Although operators also have a security department, it
does not beneft from the resources and competences of the intelligence services.
There appear to be major differences in the extent to which states gather intelligence
that may concern their operators safety. There are states that only do this within their
borders (such as Malaysia), there are states that gather intelligence beyond their borders
on a limited scale, but in principle do not regard this as an active responsibility towards
the civil aviation sector (such as the Netherlands), and there are states that regard
protecting civil aviation as a responsibility, by actively passing on the information and/or
by issuing flight prohibitions if necessary (such as the United States). These differences
undoubtedly involve a states possibilities to secure an intelligence position (capacity,
diplomatic relationships with countries, geopolitical position), but they are also the result
of the choice that states make with regard to the responsibility for the safety of operators.
The willingness of states to become embroiled in the decision made by sovereign states
to keep their airspace open also varies. The crash of flight MH17 may lead to a rethink
involving these decisions.
The military perspective dominates
As described above, a states gathered intelligence about the development of the conflict
in the eastern part of Ukraine to be able to assess what the military-strategic and
geopolitical consequences could be. This explains why a states did not make a connection
between the possible presence of powerful weapon systems and risks to air traffc flying

168

167

over the area. The list of conflict areas in other parts of the world provided a similar
picture: the military perspective is dominant and the interests of civil aviation play a
subordinate role.
Focus on intention
The investigation revealed that the parties involved view the potential risks to civil
aviation in terms of an intentional threat: the preconceived intention to shoot down civil
aeroplanes or specifc civil aeroplanes (such as those from a particular country). This
approach, which is the domain of the security departments, leaves little room for the
possibility that civil aeroplanes could be unintentionally hit by military attacks.
The observations performed at operators revealed that there, too, intention is viewed as
a precondition for a threat. As one source said: The fght in the eastern part of Ukraine
was about territory. It did not involve a terrorist group. Therefore there was no mention of
a high threat level to civil aviation.
If there is a lack of any strong indication of intention, the threat analysis stops. In this way,
the potential threat disappears from the risk assessment process very quickly and does not
reach the domain in which operational risk assessments are performed (see Figure 30).
The crash of flight MH17 demonstrates that just the (possible) presence of weapons in a
conflict area - usually referred to as capacity - means that a threat to civil aviation can be
assumed and that it is also important to determine which weapons are present, who
possesses them (regulated or unregulated troops) and whether those that possess the
weapons could have an interest in actually using them. Even without any involvement of
intention, a genuine risk to civil aviation may arise from this, which can quickly score a
high rating in the previously cited risk matrices, due to the serious consequences. The
assessment of the risks in conflict areas will thus also have to include unintentional acts.
The verifability of information from the intelligence services
A sensitive point when using classifed or confdential information is that it is diffcult for
operators to verify the information they receive (directly or indirectly from aviation
authorities) from intelligence services. In a number of states (such as the United Kingdom)
security-cleared staff from operators can obtain access to certain non-public threatrelated information and analyses that form the basis for the public risk analyses. This
makes it possible for them to acquire an insight into the value of the supplied information.
In other states operators only receive the conclusions. This also plays a role within
operators: the security department provides a threat analysis as input for the risk analysis,
but cannot reveal anything about the source due to confdentiality. Since information is
provided on a need-to-know basis and the security department determines what is needto-know, there is no guarantee that important information will not be left behind. This
process demands a high degree of confdence in the professionalism of the links at the
beginning of the chain.
Not all states possess the capacity to gather information about potential threats in other
countries. These states can still obtain information if other countries are willing to share it
with them. As a result of the crash of flight MH17, ICAO Task Force on Risks to Civil
Aviation arising from Conflict Zones (TF RCZ) advocated a central information system,

169

168

including a web application for NOTAMs, supplemented with relevant safety and security
information related to risks that conflict zones pose to civil aviation. However, it will still
be diffcult to verify this information, even with such a system. To be of value to civil
aviation, it is essential that the information be suffciently clear and reliable. The extent to
which states are willing to share information gathered by intelligence services has yet to
be established.
Focus on the ground
With regard to the conflict in the eastern part of Ukraine, the examined foreign parties
focused mainly on the development of the conflict on the ground. Government
departments, embassies and intelligence services viewed the conflict from a geopolitical
perspective. They did not recognise that the risk to civil aviation increased when the
conflict expanded to the air. This was not only true in states where the authorities did not
focus specifcally on threats to aviation, but also in states where the authorities play a
more guiding role with regard to operators based in their country flying over conflict
areas. In this sense we can conclude that due to the conflict in the eastern part of Ukraine
and its geopolitical dimensions, authorities had a blind spot when it came to risks to civil
aviation at cruising altitude. The focus of government parties was mainly on developments
on the ground. This focus on the ground emerges among authorities at the level of
information gathering and how information was interpreted.
Annex 17 to the Chicago Convention does not expressly stipulate that, e.g. when
establishing a National Civil Aviation Security Programme for aviation, which generally
focuses on in-flight security measures on the ground, states must also focus on the risks
related to using foreign airspace, although it does not preclude states from applying any
additional measures, as appropriate. Threats related to, for example, aerodromes, flight
crews, passengers and baggage are explicitly included in Annex 17. These provisions
have arisen from incidents (hijacking and explosives brought on board). Although
Annex 17 to the Chicago Convention does not explicitly rule out the risk assessment of
foreign airspace, the investigation into the crash of flight MH17 shows that many states
and operators do not use this possibility. The crash of flight MH17 reveals a lack of
provisions related to risk assessment with regard to threats to the upper airspace.
The operators examined, which strive to identify threats to existing routes and if
necessary perform a risk assessment, with regard to conflict areas mainly focus on threats
to the aeroplane on the ground. They are concerned with the security of their take-off
and landing locations (point-to-point). This was also true in the case of the conflict in the
eastern part of Ukraine. No connection was made between the conflict and potential
threats to the upper airspace.

170

169

Appendices
available via
the website

171

170

APPENDICES AVAILABLE VIA THE WEBSITE
Appendices V. Consultation Part A: Causes of the crash                                  171
Appendices W. Consultation Part B: Flying over conflict zones                         172
Appendices X. NLR Report: Investigation of the impact damage due
to high-energy objects on the wreckage of flight MH17                                  173
Appendices Y. TNO Report: Damage reconstruction caused by impact
of high-energetic particles on Malaysia Airlines flight MH17                            174
Appendices Z. TNO Report: Numerical simulation of blast loading on
Malaysia Airlines flight MH17 due to a warhead detonation                             175

172

171

APPENDIX V


CONSULTATION PART A: CAUSES OF THE CRASH

In accordance with ICAO Annex 13, the draft Final Report is submitted to the parties
involved, inviting their signifcant and substantial comments. The parties were requested
to check the report for any errors and ambiguities. The draft Final Report was submitted
to the following parties:

State

Parties

State of Occurrence - Ukraine

NBAAI
UkSATSE

State of Operator and State of Registry - Malaysia

DCA
Malaysia Airlines

State of Design and State of Manufacture
(aeroplane) - USA

NTSB
Boeing

State of Design and State of Manufacture
(engines) - United Kingdom

AAIB
Rolls-Royc

States and organisations providing information

Australia - ATSB
Russian Federation - FATA, GKOVD, JSC
Concern Almaz-Antey
EUROCONTROL

Others

EASA
ICAO

The comments received have been dealt with in the following manner:
Corrections of factual inaccuracies, additions at the detail level and editorial
comments have been adopted by the Board insofar as they were relevant. The
sections of text involved have been adapted in the fnal report. These comments
have not been specifed individually.
Any comments that were not adopted have been provided with counter arguments.
These comments have been included in a table on the Dutch Safety Boards website
(safetyboard.nl). This table contains the literal text of the comments, plus the
sections they apply to, the parties who provided them and the Dutch Safety Boards
response.

173

172

APPENDIX W


CONSULTATION PART B: FLYING OVER CONFLICT ZONES
In accordance with ICAO Annex 13, the draft Final Report is submitted to the parties
involved, inviting their signifcant and substantial comments. The parties were requested
to check the report for any errors and ambiguities. The draft Final Report was submitted
to the parties mentioned in Appendix V and to the Dutch government.
The comments received have been dealt with in the following manner:
Corrections of factual inaccuracies, additions at the detail level and editorial
comments have been adopted by the Board insofar as they were relevant. The
sections of text involved have been adapted in the fnal report. These comments
have not been specifed individually.
Any comments that were not adopted have been provided with counter arguments.
These comments have been included in a table on the Dutch Safety Boards website
(safetyboard.nl). This table contains the literal text of the comments, plus the
sections they apply to, the parties who provided them and the Dutch Safety Boards
response.

174

173

APPENDIX X


NLR REPORT: INVESTIGATION OF THE IMPACT DAMAGE DUE TO HIGHENERGY OBJECTS ON THE WRECKAGE OF FLIGHT MH17
Introduction
The impact damage due to high-energy objects on the wreckage of flight MH17 was
investigated. To investigate the possible cause of this damage, three scenarios using
different classes of weapon systems in use in the region were analysed. The following
three simulation models were used, which are described in the report: Fragmentation
Visualization Model, Kinematic Fragment Spray Pattern Simulation and the missile flyout
simulation from WEST (Weapon Engagement Simulation Tool).
The report is published on the Dutch Safety Boards website safetyboard.nl.

175

174

APPENDIX Y


TNO REPORT: DAMAGE RECONSTRUCTION CAUSED BY IMPACT OF
HIGH-ENERGETIC PARTICLES ON MALAYSIA AIRLINES FLIGHT MH17

Introduction
The purpose of this investigation is to determine the most probable detonation point of
a typical fragmenting warhead, in order to fnd the circumstances by which the observed
damage is reproduced in the best possible manner. Starting point is a warhead containing
high explosive material and preformed fragments. Terminal ballistics simulations were
performed.
The report is published on the Dutch Safety Boards website safetyboard.nl

176

175

APPENDIX Z


TNO REPORT: NUMERICAL SIMULATION OF BLAST LOADING ON
MALAYSIA AIRLINES FLIGHT MH17 DUE TO A WARHEAD DETONATION

Introduction
The objective of this investigation is to establish the blast pressure evolution for a number
of discrete points on the aircraft contour. This information can be used by the Dutch
Safety Board to predict possible failure of the aircraft structure. A so-called Computational
Fluid Dynamics (CFD) simulation has been performed to provide high-fdelity quantitative
description of the blast loading.
The report is published on the Dutch Safety Boards website safetyboard.nl.

177

176

Visiting Address
Anna van Saksenlaan 50
2593 HT The Hague
T +31(0)70 333 70 00
F +31(0)70 333 70 77
Postal Address
PO Box 95404
2509 CK The Hague
safetyboard.nl


» MH17: ? »  DSB JIT »  DSB 13.10.15: MH17 Crash Appendices A-U