151

safety net was in place. This raises questions about the organisation of the system of
responsibilities and current practice for assessing the risks that armed conflicts pose to
civil aviation.
This appendix describes how parties cooperate in the system, in collecting and assessing
risk information about conflict areas in relation to civil aviation. What differences can be
observed and what vulnerabilities characterise the risk assessment process? The Dutch
Safety Board aims to use this to lay the foundations for lessons that can be learned.
In this appendix, the Dutch Safety Board devotes attention to states as well as operators.
States play a major role in decision-making processes related to conflict areas because
they usually have more possibilities than operators for gathering intelligence. Operators
choose from the available flight routes. The investigation therefore focuses on the way in
which operators assess threats and risks related to their flight routes over conflict areas.
This naturally applies to situations in which the airspace is open and in which operators
are not subject to any flight bans imposed by their national authorities. For this part of
the investigation, data were obtained from thirteen operators and eight states. The data
have been made anonymous at the request of the parties, who cooperated voluntarily,
given that they were not parties involved in the crash of flight MH17.
In this appendix, the Dutch Safety Board uses the following illustrative categorisation of
the risk assessment process

Figure 26: Steps in the risk assessment process. (Source: Dutch Safety Board)

• Information gathering (and sharing): gathering information from diverse sources
related to a potential threat and sharing information with other parties (‘What could
happen? Are there intention and capability?’)
• Threat analysis: determining the probability of a threat occurring.
• Risk analysis: estimating the risks to the operator, based on vulnerability and
consequences.
• Decision-making: to fly or not to fly. If the decision is made to fly, are additional
measures necessary?
The various steps are not always strictly differentiated. However, there is a logical order:
information gathering about risks is performed prior to its assessment. Whether and
which parties gather information depends on how they interpret their responsibility.
Therefore, this appendix will frst address how states and operators interpret their
responsibilities.

153

Information provision by the authorities
In some countries, including the Netherlands and Australia, the authorities can provide
operators with threat-related information to support their threat analysis, risk assessment
and decision-making processes. The way in which and the extent to which authorities
provide information in this practice differs from one country to another. It is possible for
a national authority to only provide operators with informal information, to support their
risk assessment and decision-making processes. Personal relationships and trust play a
major role in these types of informal contacts; in many cases it concerns information that
originates from the intelligence services, which must be protected. As a result, it is
possible that not all operators have access to the same information sources.
There are also countries that provide information to (national) operators on a formal
basis. In this case there is a formal procedure that regulates the provision of information
and the handling of confdential information.
Information is then provided via an offcially designated contact at a government service
(such as an account manager for civil aviation). The operators can also report any
information they may have to this contact.
The initiative involved in information exchange is generally taken by the operators in this
practice. In the event of a specifc threat, the authorities actively communicate the
situation to the operators.
Recommendations provided by the authorities
The investigation revealed that there are authorities that not only (informally) provide
their national operators with threat-related information, but also provide aviation-specifc
risk analyses or issue a recommendation based on this information. Some states, such as
France, take it a step further and issue formal (whether urgent or not) recommendations
and warnings, such as in the form of NOTAMs, about destinations and flight routes
outside its own airspace. The operators include this advice in their decision-making
process.

Regulation by the authorities
In a number of countries the authorities can prohibit operators based in that country
from flying to specifc destinations or from using (part of) foreign airspace. The state
concerned uses this option if the need arises, based on intelligence and its own threat

155

more extensive guidance say that they use the information they receive from their own
intelligence services.105 In addition, these authorities, like operators, participate in
informal and formal networks with other national and foreign governments to exchange
and verify information.
In general, in situations in which national authorities inform or advise their operators
about flight routes or prohibit them from flying somewhere, they mutually exchange
information. During the information gathering and threat and risk analysis processes, the
authorities are in contact with the operators and the latter can ask questions and verify
information as well as provide information. One of the authorities involved, for example,
stated that it has also received threat-related information that operators have, in turn,
gathered through their stations in other countries.
Once threat-related information has been gathered, the threat analysis and subsequently
the risk analysis and decision-making processes take place. In some states, the authorities
that advise operators base their advice on threat-related information (analysis) from a
different government party and ‘translate’ it into risk information for their registered
operators. In other states, in practice, the distinction between threat and risk analysis is
less strict and these processes are performed by a single body. The authorities concerned
say that they also examine the probability of the identifed threats. These authorities
then examine which measures are possible, such as in the form of an altitude restriction.106
Four practices and their implications
The differences identifed in the way in which states manage their responsibility related
to safe flight routes for their operators are important for learning lessons from the crash
of flight MH17. Especially the two most extreme practices involve disadvantages.
A state that adopts a detached role (‘practice 1’) considerably reduces the chance of
operators in the state concerned being able to receive confdential information related
to the potential lack of safety along one of its flight routes. This increases the need for
those operators to actively gather relevant information, and not all operators have the
same resources for doing so. Moreover, operators have fewer possibilities than states for
gathering information about conflict areas.
States that are able to impose flight prohibitions on their operators (‘practice 4’), offer an
additional barrier for limiting risks. They cause a shift in the distribution of responsibility
between the state and the operators based therein. When they actually impose a
prohibition, states deprive the operators’ of their ability to perform an independent risk
assessment and thus to fulfl their responsibility.

105 This information may however also involve conflict areas in general. It is also unknown whether the involved
intelligence services in these states actually examine threats to the aviation sector or whether this ‘translation’ is
produced later on in the process by state bodies that process the intelligence to produce aviation-specifc
analyses.
106 The Dutch Safety Board does not know the extent to which authorities in these states proactively took upper
airspace into consideration in their risk analyses for civil aviation prior to the crash of flight MH17 and whether the
crash resulted in changes to information gathering, threat analysis and risk analysis processes.

157

relevant state.107 Annex 17 includes provisions for operators mainly related to security at
aerodromes or in the aircraft. The safety of flight routes through foreign airspace is not
part of the regulations. The safety of flying over countries can, as part of the flight, also
be the focus of a security department but this is not standard practice among all
operators.

Table 15: Differentiation between risk assessment related to safety and security in aviation.

Information gathering
Firstly, to be able to perform a risk assessment it is important to possess relevant threatrelated information about a specifc area and the airspace concerned. Operators can use
diverse sources in this respect.
Aeronautical information
As previously mentioned, the formal provision of information by airspace managers
(authorities) to airspace users (operators) takes place through NOTAMs. However, it
turned out that NOTAMs rarely contain information about threats above conflict areas.
Other aviation organisations and authorities also provide information communication.
Media reports
Operators use media such as newspapers, magazines and television to identify potential
threats to their flight routes and destinations. Some operators also follow social media.
Various operators revealed that they subscribe to daily newsletters and regularly consult
databases to stay up-to-date about risks to the aviation sector and other developments
related to security throughout the world.108

107 Annex 17 to the Chicago Convention may afford states room for a broad interpretation in which risks to foreign
flight routes are also part of the National Security Plan, but the elaboration in the ‘Aviation Security Manual’
illustrates that such a broad interpretation is uncommon.
108 For an example see: http://ww1.jeppesen.com/company/alerts/alerts.jsp (consulted on 10 March 2015).

159

Within these networks there are (partially) open as well as closed circuits in which the
parties exchange confdential or classifed information. One example of a closed circuit is
the network of operators within an airline group, which means a group of operators that
work together. These closed circuits are characterised by the fact that sources of received
intelligence are shared relatively freely. In (more) open circuits intelligence is shared, for
example, between alliance partners and code share partners (‘befriended’ operators)
and information sources will not be revealed or will be but to a limited extent. Both cases
involve reciprocity: operators in these networks provide and receive information.
There are operators that obtain non-public information in an informal manner via their
national authorities. Government parties with which these operators maintain contacts
include ministries, embassies, defence attachés and other military informants and
intelligence services. The extent to which operators obtain information from their
authorities varies from one country to another and from one operator to another. The
type of threat-related information the operators receive also differs. In one of the states
examined, an operator revealed that it regularly obtained formal and informal information
from the authorities. In other states, operators revealed that they had to request
information and verify it using their own network. In these cases, the contacts are often
informal and personal, unstructured and not institutionalised. One operator stated that it
received information from the intelligence services more often than other operators in
the same state ‘due to a personal connection’.
Sector-specifc analyses and (formal) recommendations from operators’ own authorities
As described before, there are also states in which operators form part of institutionalised
networks with their national authorities. In these states, the authorities collect and analyse
intelligence for operators related to foreign airspace and destinations, and provide
operators with additional, sector-specifc information, such as risk analyses. Operators in
these states also receive advice from their authorities.
Interpreting information
Operators may arrive at a different decision based on the same information. This indicates
that there are differences in the way operators interpret and weigh information.
Threat analyses
Threat analyses focus on determining the general threat level. There are differences in
how operators perform threat analyses, but several generic steps can be broadly
differentiated (see Figure 30). If information is found related to a possible threat to the
aviation sector, operator or involving a flight route or destination, this specifc information
is analysed systematically.

161

Figure 30: Example of decision-making at an airline. (Source: Dutch Safety Board)

Risk analysis
The threat analysis serves as input for the risk analysis that follows. The risk analysis
translates the threats into risks facing the operator. These could be risks to the
organisation in general (such as the ‘organisation’s objectives’ or ‘reputation’), as well as
more specifc risks to the continuity of commercial activities and the safety of people
and/or property. The risk analysis determines vulnerability and considers the
consequences of not taking mitigating action by the operator.
When studying the risks, the operator produces an estimate of the probability of an incident
occurring. Statistical data are leading when determining the probability of a particular
incident occurring: has the incident already occurred in the past, and if so, how often? By
examining historic series, the operator can estimate a scenario’s statistical probability. It
weighs the probability against the potential impact, namely the expected severity and
scope of the damage. It does so using a risk matrix. Risk matrices may differ from one

163

Each operator performs its own risk assessment. Different factors can play a role when
assessing the identifed risks with regard to the flight route, such as the number of flights an
operator operates on a route (the more often you fly, the greater the risk that something
can happen to one of the aeroplanes, but also the greater the route’s importance in
commercial terms), the relationship with the states to or over which an operator flies (an
operator from a state that is at war with another state runs a greater risk of being attacked)
and the nature of the armed factions (are they hostile to certain states, are they disciplined?).
An operator’s history of incidents can also play a role: if an operator has previously been
involved in an incident in or above a conflict area, it may be more inclined to avoid the
situation. Thus operators that possess the same threat-related information may, nevertheless,
come to a different conclusion, also with regard to flying over conflict areas.112
Factors related to conflict areas that increase risks
For conflict areas over which civil air traffc is still possible, it is important to obtain a picture
of the factors that could increase risks to civil air traffc flying over it. To this end the Dutch
Safety Board identifed, insofar as is possible, characteristics that could be relevant for
determining risks to civil aviation, for a number of conflict areas, including Ukraine.113
The conflicts that pose the greatest threat to civil aviation are those in which non-state
parties are involved. Such conflicts are characterised by a high degree of unpredictability.
It is diffcult to ascertain the weapons systems these parties possess. Furthermore, these
parties are not bound by international treaties and conventions and their intentions are
unclear with regard to parties not directly involved in the conflict.
The weapons systems that could pose a threat to civil aviation are primarily anti-air
missiles. MANPADS are present in most of these conflict areas, but their range is lower
than the altitude at which civil aeroplanes fly over the area. Insofar as can be determined,
medium or long-range surface-to-air missiles are not present in most of the conflict areas
described here. Conflicts in which major powers that do possess these weapons are
involved (behind the scenes), present a greater possibility that they will become available
than in other conflicts. Additionally, fghting factions seized these types of systems from
the state’s armed forces in several conflict areas. It is not known whether these factions
possess the knowledge and skill needed to actually use the systems seized, but it cannot
be ruled out that they are able to obtain the necessary knowledge and skill.

112 One example of this is a report in the media (Noordhollands Dagblad, 4 May 2015) that one Turkish Airlines flight
crosses conflict areas near Mosul and Tikrit in Iraq, while other airlines avoid Iraq and fly via Iran and Turkey.
113 It concerns the situation at the time the inventory was performed: July 2015. See section 6

165

An effective risk assessment largely depends on the quality of the information and the
way in which parties interpret the information and assess risks. This section discusses the
vulnerability inherent to these processes. Vulnerabilities are: the fundamental principle
that ‘flying is the standard’, the varying and sometimes limited interpretation of their
responsibilities by states and operators, the dominant military perspective, the focus on
intention, the focus on the ground, operating from the perspective of destinations and
problems with sharing classifed and confdential information.

By default, flights take place
The international civil aviation system is based on the assumption that, in principle, civil
air traffc is always possible: flying is the standard. States managing airspace shall impose
as few restrictions as possible. This system can provide an incentive to keep the airspace
open if potential dangers to air traffc are not yet entirely clear.
Flying is also the standard for operators. When it comes to new flight routes, they assess
whether they want to fly somewhere, whereas continuing to fly along existing routes over
conflict areas is a ‘non-decision’ in most cases. The investigation revealed that operators
only reconsider existing routes for safety reasons if there are specifc indications of
danger. This largely determines how operators collect and interpret threat-related
information: they wait until an actual threat has been identifed. They use available
information to justify continuing to fly and to carry on doing exactly what they were
already doing.116 This perspective was observed with regard to flying over the eastern
part of Ukraine: the operators viewed the NOTAMs issued by Ukraine prior to 17 July 2014
as a signal that Ukraine was managing the airspace; not as an indicator for the worsening
safety situation in the airspace.
States and operators’ understanding of their responsibilities
The more a state or operator actively collects information about threats, the greater the
chance that it will identify threats that are not actively reported by a state that is involved.
There are operators that rely entirely on aeronautical information that is provided to

116 This is a general pattern of behaviour. Bazerman and Watkins (2004:7) refer to the human tendency to maintain the
status quo: ‘When a system still functions and there is no crisis to catalyse action, we will keep doing things the
way we have always done them.

167

over the area. The list of conflict areas in other parts of the world provided a similar
picture: the military perspective is dominant and the interests of civil aviation play a
subordinate role.
Focus on intention
The investigation revealed that the parties involved view the potential risks to civil
aviation in terms of an intentional threat: the preconceived intention to shoot down civil
aeroplanes or specifc civil aeroplanes (such as those from a particular country). This
approach, which is the domain of the security departments, leaves little room for the
possibility that civil aeroplanes could be unintentionally hit by military attacks.
The observations performed at operators revealed that there, too, intention is viewed as
a precondition for a threat. As one source said: ‘The fght in the eastern part of Ukraine
was about territory. It did not involve a terrorist group. Therefore there was no mention of
a high threat level to civil aviation.’
If there is a lack of any strong indication of intention, the threat analysis stops. In this way,
the potential threat disappears from the risk assessment process very quickly and does not
reach the domain in which operational risk assessments are performed (see Figure 30).
The crash of flight MH17 demonstrates that just the (possible) presence of weapons in a
conflict area - usually referred to as ‘capacity’ - means that a threat to civil aviation can be
assumed and that it is also important to determine which weapons are present, who
possesses them (regulated or unregulated troops) and whether those that possess the
weapons could have an interest in actually using them. Even without any involvement of
intention, a genuine risk to civil aviation may arise from this, which can quickly score a
high ‘rating’ in the previously cited risk matrices, due to the serious consequences. The
assessment of the risks in conflict areas will thus also have to include unintentional acts.
The verifability of information from the intelligence services
A sensitive point when using classifed or confdential information is that it is diffcult for
operators to verify the information they receive (directly or indirectly from aviation
authorities) from intelligence services. In a number of states (such as the United Kingdom)
security-cleared staff from operators can obtain access to certain non-public threatrelated information and analyses that form the basis for the public risk analyses. This
makes it possible for them to acquire an insight into the value of the supplied information.
In other states operators only receive the conclusions. This also plays a role within
operators: the security department provides a threat analysis as input for the risk analysis,
but cannot reveal anything about the source due to confdentiality. Since information is
provided on a need-to-know basis and the security department determines what is needto-know, there is no guarantee that important information will not be left behind. This
process demands a high degree of confdence in the professionalism of the links at the
beginning of the chain.
Not all states possess the capacity to gather information about potential threats in other
countries. These states can still obtain information if other countries are willing to share it
with them. As a result of the crash of flight MH17, ICAO Task Force on Risks to Civil
Aviation arising from Conflict Zones (TF RCZ) advocated a central information system,

169

Appendices
available via
the website

171

APPENDIX V

CONSULTATION PART A: CAUSES OF THE CRASH

In accordance with ICAO Annex 13, the draft Final Report is submitted to the parties
involved, inviting their signifcant and substantial comments. The parties were requested
to check the report for any errors and ambiguities. The draft Final Report was submitted
to the following parties:

The comments received have been dealt with in the following manner:
• Corrections of factual inaccuracies, additions at the detail level and editorial
comments have been adopted by the Board insofar as they were relevant. The
sections of text involved have been adapted in the fnal report. These comments
have not been specifed individually.
• Any comments that were not adopted have been provided with counter arguments.
These comments have been included in a table on the Dutch Safety Board’s website
(wwwsafetyboard.nl). This table contains the literal text of the comments, plus the
sections they apply to, the parties who provided them and the Dutch Safety Board’s
response.

173

APPENDIX X

NLR REPORT: INVESTIGATION OF THE IMPACT DAMAGE DUE TO HIGHENERGY OBJECTS ON THE WRECKAGE OF FLIGHT MH17
Introduction
The impact damage due to high-energy objects on the wreckage of flight MH17 was
investigated. To investigate the possible cause of this damage, three scenarios using
different classes of weapon systems in use in the region were analysed. The following
three simulation models were used, which are described in the report: Fragmentation
Visualization Model, Kinematic Fragment Spray Pattern Simulation and the missile flyout
simulation from WEST (Weapon Engagement Simulation Tool).
The report is published on the Dutch Safety Board’s website wwwsafetyboard.nl.

175

APPENDIX Z

TNO REPORT: NUMERICAL SIMULATION OF BLAST LOADING ON
MALAYSIA AIRLINES FLIGHT MH17 DUE TO A WARHEAD DETONATION
Introduction
The objective of this investigation is to establish the blast pressure evolution for a number
of discrete points on the aircraft contour. This information can be used by the Dutch
Safety Board to predict possible failure of the aircraft structure. A so-called Computational
Fluid Dynamics (CFD) simulation has been performed to provide high-fdelity quantitative
description of the blast loading.
The report is published on the Dutch Safety Board’s website wwwsafetyboard.nl.