Security researcher's hack caused airplane to climb, FBI asserts

The researcher, Chris Roberts, was questioned by the FBI on April 15 after he wrote a tweet that suggested he was probing aircraft systems on a United Airlines flight he took earlier that day.

The FBI interviewed him after he flew into Syracuse, New York, and seized his electronics. Two days later, the agency then filed an application for a search warrant to examine Roberts' gear, which has been published in federal court records.

The application contains rich detail describing three of the agency's interviews with Roberts, who is co-founder and CTO of the security company One World Labs in Colorado. He has not been charged with a crime, although United Airlines banned him from flying on its planes.

It is not clear when the incident involving the airplane's engine occurred or if the plane might have been in danger as the result of it.

On Sunday, Roberts wrote on Twitter that "Over last five years my only interest has been to improve aircraft security...given the current situation I've been advised against saying much." Roberts is being represented by Nate Cardozo, a staff attorney with the Electronic Frontier Foundation. Cardozo said Roberts was not available to comment beyond what he wrote on Twitter.

One of Roberts' specialties is investigating security flaws in aircraft systems, which the U.S. government has warned could endanger flight safety if not configured correctly.

Regarding the engine incident, Special Agent Mark S. Hurley wrote in the warrant application that Roberts said he connected his laptop to the in-flight entertainment (IFE) system through the Seat Electronic Box (SEB), which is located under some passenger seats.

After hacking the IFE system, he gained access to other systems on the plane, Hurley wrote.

Roberts "stated that he then overwrote code on the airplane's Thrust Management Computer while aboard a flight," Hurley wrote. "He stated that he successfully commanded the system he had accessed to issue the 'CLB' or climb command."

One of the airplane's engines began to climb, "resulting in a lateral or sideways movement of the plane during one of these flights," the warrant application said.

Hurley wrote that Roberts said he had compromised IFE systems 15 to 20 times from 2011 through 2014.

Roberts allegedly said he compromised IFE systems made by Thales and Panasonic with video monitors installed at the back of passenger seats, Hurley wrote.

Roberts' problems started on April 15 when he wrote a tweet that suggested he was probing aircraft systems on a United Airlines flight from Denver to Chicago on a 737/800.

He continued flying that day from Chicago to Syracuse, New York. While en route, United Airlines' Cyber Security Intelligence Department had seen his tweet, which referred to the EICAS system, or Engine Indication and Crew Alerting System.

According to the warrant application, an FBI special agent later examined the first-class cabin where Roberts flew on his way to Chicago. The SEBs under seats 2A and 3A showed signs of tampering.

"The SEB under 2A was damaged," the document said. "The outer cover of the box was open approximately 1/2 inch, and one of the retaining screws was not seated and was exposed."

Roberts told agents that he did not compromise the airplane's network on the flight to Chicago, the warrant application said.

In February and March, the FBI had interviewed Roberts in which he allegedly also told agents he had hacked IFE systems on aircraft before.

Hurley wrote they seized his equipment in Syracuse because "it would endanger public safety to allow him to leave the Syracuse airport that evening with that equipment."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk