A security consultant is at the centre of a media storm following claims that he hacked into the computer systems on board airplanes on a number of occasions, and during one of those he allegedly managed to take partial control of the craft.
Chris Roberts was picked up by the FBI last month following tweets about hacking into the plane’s systems on a United Airlines flight from Chicago to Syracuse, and upon landing he had his kit – a MacBook Pro and iPad Air – seized in order to be scrutinised by their techies.
CNN, which spotted the search warrant application filed to investigate the security expert for possible computer crime, reports that Roberts had been questioned by the FBI in February and March, and freely admitted he’d hacked in-flight entertainment (IFE) systems on board planes up to 20 times during 2011 through to 2014.
He offered all these details up because Roberts said he wanted the vulnerabilities in the IFE systems with three different Boeing jets, and the Airbus A320, fixed.
Roberts underlined this point in a recent tweet: “Over last 5 years my only interest has been to improve aircraft security...given the current situation I've been advised against saying much.”
However, the FBI claims that on one occasion he hacked into systems and overwrote code which actually allowed him to give the plane a command to climb – the warrant document says: “[Roberts] stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane during one of these flights.”
Obviously that’s a more than worrying security flaw – however, Roberts contends that this affair isn’t what it seems on the face of it. In another tweet, he said: “Sorry it's so generic, but there's a whole 5 years of stuff that the affidavit incorrectly compressed into 1 paragraph....lots to untangle.”
So what the FBI is saying isn’t fully correct, it would seem, and the full truth here is a thornier affair – though it’s difficult to know how given that Roberts has been advised to say nothing at this point. Further answers will no doubt emerge in due course…