How I broke the Ethiopian Airlines #ET702 hijacking on Twitter

11:05pm: “OH MY GOD A PLANE HAS BEEN HIJACKED”

John Walton
15 min readFeb 19, 2014

That’s how I started learning that ET702 and the hundreds of passengers on board was being hijacked and flown to Geneva by its co-pilot in order to claim asylum: in a text chat with some friends on a Sunday night.

Squawking 7500 — in other words, transmitting the code assigned to hijacked aircraft — since it was over Africa, I’d seen brief mention of ET702 earlier in the evening.

It’s by no means unheard of for aircraft to squawk the wrong transponder code by mistake: it can be the airborne equivalent of pocket-dialing your phone. With no official confirmation, I had gone back to watching the final few episodes of House of Cards Season 2, hoping I could finish off the season before bed. Knock knock.

Then Skype started pinging at me. A couple of Australian friends and I keep a group text chat going as a way to keep in touch and discuss things we’re interested in, like the future of Australian aviation, travel tech startups, and what’s going on in the industry.

11:12pm: Turning

11:12pm: Right towards GVA

11:12pm: But surely still too high for GVA

I typed those words as the aircraft made its turn to the northwest just before overflying Annecy. I was right in terms of the aircraft’s altitude: it eventually required a series of looping turns over Geneva and Lac Léman to slow and descend for landing.

The eventual flight path of ET702 bypassed Rome, started descending over the Western Alps, circled Geneva and landed at GVA. At the time (early in the morning European time) significantly fewer aircraft were in flight.

Flight maps like this one are screenshots of Flightradar24.com, which also provides aircraft type, registration, altitude, speed, heading, and the all-important squawk code. This is publicly available information on a free-to-use website; I also pay for the iOS app.

My subject matter expertise in aviation—and my day job as Director of Data at flight rating, search and data site Routehappy — make tools like this a part of my daily life. I’m as familiar with them as I am with email or Facebook.

And as an aviation journalist, I know how the media works. Interspersed here, you’ll find points I learned from the experience of breaking and developing this story — for specialists, for new or old media outlets, and for journalists.

Learning point: I didn’t need non-public access to systems in order to interpret and disseminate useful information.

Learning point: I did need to understand how the subject matter works in order to interpret and disseminate useful information.

The color of the track moves from blue through to green, yellow and white, denoting altitude. The aquamarine color for most of the holding pattern over Geneva is approximately 7000 feet.

I started comparing the aircraft’s position to the Google maps of Geneva and its surroundings — which I know relatively well, having spent several summers there as a child.

When ET702 made its first turn (the sharp one, in blue, above) I started figuring out where it might be heading.

The (A) pin from Google Maps is on St Prex, which is the start of the descent into Geneva Airport from the northeast. Geneva Airport is roughtly above the word “Pâquis”, centre bottom left. Note also the Jura mountains to the west and northwest of Geneva— at 5643 feet, the Crêt de la Neige summit was just under 1500 feet below ET702's holding pattern.

The aircraft’s position and height made me think that Geneva might not initially be the intended destination. As you can see, the first turn at altitude was significantly south of the point where aircraft approach for runway 23.

I thought it might be heading for Zurich — though I hadn’t yet started tweeting about #ET702.

11:14pm: Because GVA is right on the French border

11:14pm: Like, the side of the runway is France

11:14pm: The terminal is half French

I said that knowing that the Swiss-French nature of Geneva’s airport can make things complicated. You can leave the terminal to either country, or even exit directly into France on a French domestic flight without passing through Switzerland.

The central terminal area is above the train symbol and E62 label in the center of the map.

(As it turned out, things were indeed complicated: non-Swiss fighters escorting an aircraft into Swiss airspace will, I’m sure, provide a useful command-and-control case study.)

One of my friends pulled up the approach plate for GVA’s runway 23 ILS and I started trying to figure out where ET702 was heading.

I first started learning about charts like these as a child flying across the Atlantic between NYC and London. It’s amazing what you used to be able to pick up on a long transatlantic day flight as a curious small boy on the flight deck with bored pilots and an inquiring mind. If these charts are less familiar to you, the key things to note are the height at the top of the glideslope (7000', bottom right hand side) and the location of the end of the loop (St Prex, top right). St Prex is about twice as far away from Geneva than Nyon, which you can see in the previous map — meaning that the holding pattern was not close to the top of the glideslope.

At 11:20pm, one of my friends linked us to the Geneva arrival/departure tower frequency. Like the live flight tracking map, this is publicly available information on a free-to-use website.

Learning point: having specialist support in a backchannel — the text chat was essentially my newsroom — allowed me to disseminate more information more quickly.

Of course, to make sense of ATC you need to be familiar with how aircraft and towers communicate. I’m fortunate enough to have been taught by pilots when I was young (see previous sidebar) and developed the ability while photographing aircraft as part of being an aviation journalist.

As a relatively fluent French speaker, I was also able to make more sense of the tower’s accent and speech patterns, and was able to interpret several communications in French between the tower and non-ET702 aircraft and ground equipment.

Learning point: local knowledge and language ability significantly increased my ability to be a useful source.

Listening to ATC, I was stunned by what I heard at 11:24pm.

My first tweet on the #ET702 timeline

I figured someone had to get the word out, because the aviation media had dismissed the earlier 7500 squawk over Sudan, and the general media wasn’t going to pick this up for hours. (They didn’t.)

From there, I started summarizing what I knew. The squawk, the flight path and the ATC were enough confirmation for me. I knew the aircraft and how it should be behaving. I knew Geneva and its airport.

And I knew hijacking, and specifically hijacking with reference to asylum — I hold a MA in International Relations with a specialty in international terrorism, and wrote extensively about the 2001 modality shift from negotiation with hijackers to shooting them down.

Of all the many knowledgeable people I know across multiple fields, I was the best placed to break this news.

What I didn’t know yet was the callsign. Instead of ETHIOPIAN 702 or even Echo Tango 702, I was hearing Kilo Kilo 001.

I then started hearing information about the requests for asylum. Remember, at this stage nobody knew that the co-pilot was the hijacker.

The meme about the Swiss all being asleep started here too.

And then we learned more about why the aircraft was starting to circle.

From there, I started putting things together in my mind, but in the blur of transcribing, posting and getting Tweetdeck notification dings, I missed some of it.

So I was very careful to note my uncertainty in my tweet. That’ll become important later.

It turned out to be closer to 25 or 35 minutes than 75

From there, ET702 started doing loops over Geneva. Clearly, with high-value political and international targets like the UN in Geneva, that’s less than desirable.

It’s not the standard holding track for the northwest approach (see the approach plate above), and I didn’t hear ATC giving the pilot vectors for the holding track at this point, so I’m not certain whether the pattern was official or made up on the fly. Whatever the case, it’s quite fortunate that this was very early in the morning local time, since there was no other visible air traffic nearby.

I started to notice the three smaller aircraft apparently moving around the airport. These turned out not to be aircraft at all, but emergency vehicles. Geneva and some other airports issue transponders and identifiers to their operational and emergency ground vehicles. It was a little odd to see a track like this for an aircraft…

I was so heavily in listening-to-French-accents mode that my brain mis-typed the homonym “Magelan”.

At that point, ET702 broke the pattern and started heading southwest.

And then I heard why:

ET702 then started doing an entirely new set of loops to the southwest of the original set. Again, I didn’t hear these being ATC-directed. And I started a clock counting down from the aircraft’s 20-minute fuel call. 12:03am in my timezone.

My friend Cynthia Drescher at Jaunted had started tweeting around that time — a big relief to have other knowledgeable aviation specialists with their eye on the ball.

Other journalists, including @MatthewKeysLive, started twigging that something was up at this stage too. His first tweet came at 11:43pm, and I was relieved when he also started reporting based on ATC and Flightradar24 data as well, particularly when information was coming hot and heavy and it wasn’t possible to transcribe, summarize and tweet everything at once.

Learning point: figuring out who the useful sources were and being able to rely on them for confirmation was immensely helpful.

At this point, I had to turn off Twitter notifications — the constant bing-bing-bing of retweets and questions was maddening.

Learning point: know your technology. I was glad I knew how to turn off Twitter’s sound easily, while keeping the ATC audio going.

The pilot reported that one engine had flamed out a minute later.

Images of Ethiopian 961 in 1996 sprang to mind, and water landings are not always the Cactus 1549 Miracle on the Hudson type.

This seemed the last resort option under the scenario that seemed most likely at the time: hijackers forcing pilots to fly the plane.

Ethiopian 961 ran out of fuel nearly two decades ago; it seemed plausible that the pilots might be keeping Ethiopian 702 close to the lake in order to enable a Gimli Glider-style controlled descent into water.

Shortly afterwards, I heard the tower directing the aircraft towards the top of the ILS glideslope for runway 05 — the opposite runway direction to the runway 23 approach.

I noted something at the time that turned out to be true:

The pilot sounded like he knew what he was doing, was using standard communication protocols and was referring to procedures professionally. Then, I had no reason to think that there weren’t multiple pilots — the ATC feed was as crackly as it usually is, and while accents were distinguishable two pilots of similar vocal timbre would not have been.

Keeping an eye on the clock, I started to get concerned that the pilots would be forced to perform a go-around if their demands for asylum were not met. The ATC controller, keeping it professional, continued to guide them in towards the start of the approach.

At that point, Twitter notifications were coming in thick and fast, and I noticed that people were retweeting old information. It was clear that I needed to get updates out as over a thousand people started following me for updated details.

Learning point: there came a point where I was a primary source for this information; I needed to bring people just joining the story up to speed.

I was also receiving numerous requests from media for interviews — and all but one were on Twitter. I’d had to turn off Twitter audio notifications, so this was just noise in my feed. At the same time, doing interviews during the heat of the landing was obviously not an option. All my attention was focussed on keeping up with ATC and the track.

Learning point: I could have stated how I wanted media to contact me earlier. I now know that taking it off Twitter, into email and onto the phone, would have been the most efficient plan at an earlier stage.

As it approached midnight in my timezone, I heard ATC vectoring ET702 towards the start of the ILS glideslope and giving them a four-mile countdown. The track matched. I checked my timer. Eleven minutes left of fuel.

Ten minutes of fuel, and nothing from the Swiss. (Looking back, if the air force only works business hours, imagine what the foreign ministry’s overnight coverage is like.)

Eight minutes of fuel.

Seven minutes. I observe as I watch and listen that the track looks like a very oddly drawn treble clef.

Six minutes of fuel remaining, and the Swiss haven’t come through. Eyeballing the map, it seems like there’s only time for one try at landing. A go-around means running out of fuel. No space to turn left at low altitude: 5600 feet of Jura mountains to the left and 4500 feet of the Salève to the right.

Five minutes, and another exchange about asylum. The aircraft slows below 200 knots.

Looking back, who knows whether the air traffic controller was bluffing, and if so, why? Were the authorities feeding him a “nobody can take your call” message and some platitudes? Or was it genuine?

Four minutes of fuel remaining, and the controller is giving the pilot the standard landing information he’ll need.

The last thing I hear for two long minutes is that there is not yet an answer to the asylum request. It’s quite a long two minutes.

And then, with just two minutes of fuel remaining:

I watch the emergency vehicles’ transponders zipping around the runway.

The final communication from the aircraft is this:

All the while, I’m looking at the track, and realize that anyone not listening to ATC might imagine that the aircraft had missed the runway entirely.

Flightradar24's ADS-B mapping isn’t always precise. I’ve watched airplanes land from the lounge window in JFK that Flightradar seems to suggest have splashed into Jamaica Bay outside. I reiterate that the plane has indeed landed.

Learning point: Looking back, I recall that I found it difficult to put into simpler words that the mapping isn’t always precise. If I’d been able to find those words, it could have been helpful for non-specialists.

Five minutes later, no news or activity. With more retweeting of old “the plane is in the air” tweets going on, I made sure to post regular updates.

I was fielding media requests hard and fast. Sky in the UK. Russia Today. Australian stations in Perth and Sydney. Johannesburg. And still trying to listen in to the tower as I was talking on the phone. “Please follow and DM” wasn’t really getting a look-in.

Learning point: media colleagues, the “please follow and DM” option is not practical. “Here is my number” or “Here is my email” or even “Here is my Skype” would have upped your chances of being first on the call list.

Learning point: it would have been useful to have had the ability to delegate ATC transcription to someone else, but a lot of it was in French, and I had the best French of my backchannel friends. Fortunately, I had the presence of mind to start audio recording on my iPhone, which came in quite useful later on.

Another update, ten minutes later. At this point, I started seeing generalist media reporting on #ET702. As an aviation journalist, it’s incredibly frustrating when the generalist media shows its ignorance about my subject area, and very few outlets have decent aviation or airline staffers any more.

So I started tweeting out what seemed to me very basic information in the hope that the media echo chamber would pick it up.

An observation from later: it seems the New York Times wasn’t reading Twitter.

Learning point: the information is almost certainly out there on Twitter, in reverse chronological order. The Times could have saved itself the embarrassment by having aviation expertise (Ethiopian has no 737-600, and if they did it wouldn’t be flying Addis-Rome) and by reading Twitter.

It also seemed appropriate to highlight my own circumstances and credentials at this point, especially since more than one person assumed I was on the flight.

I also thought it was right to thank my backchannel friends publicly.

Liam also spotted this moment of levity, and I couldn’t resist.

And then it was back to the basics.

Plus a bit of updating non-Francophones on what ATC was saying.

Ethiopian Airlines made its first comment on the matter nearly an hour after the plane landed.

Learning point: there may be many reasons why the airline did not issue a statement — security, staffing, chain-of-command—but if the “no statement” policy was by omission rather than commission, the airline needs to look at its internal workings.

Within fifteen minutes, Ethiopian’s statement was gone.

Learning point: screencaps are instantaneous and easy. I was glad several times that I had screencapped things, not just here.

Ten minutes later, the release had reappeared.

Several Twitter users were reading older tweets and were dubious about its disappearance now that it had reappeared. So I responded:

Meanwhile, Cynthia was not only tweeting but also putting together a story. She and other aviation specialists were adding details to their breaking articles that had been up for some time.

Learning point: at some point, the news becomes less about what’s happening live and on Twitter and more about how the story developed and what happened. I either needed to pass it on or sum it up myself.

Around this time, I made a mistake. I was probably sorting out the press release screenshots and mis-heard BA 723's discussion with the tower about disembarking its passengers in five minutes.

The voice was different, and British in accent; I assumed perhaps some pilot or airport ground operations staffer assigned to sort out matters with the escape of the original flight crew out the window.

Cynthia’s point fit with my own, yet on checking my phone I’d clearly erred. I deleted the original tweet about “disembarking in five minutes” and issued a clear correction.

Learning point: I got things wrong; I corrected them quickly. That’s all you can do in a situation like this, but you must do it. Simply deleting tweets without corrections isn’t acceptable.

As the rumours of arrested pilots started to flow, I issued a quick “what we know”.

I was also clear about what I heard circulating but was unable to confirm.

Learning point: at this stage, widespread use of Chris Shipley’s excellent #CommonTags project would have been very helpful as information started to flow through local Swiss sources in German and French into media in those languages.

I listened back to the ATC recording on my phone, and fortunately @MatthewKeysLive had been funnelling ATC to Soundcloud, so I was able to start some clearly marked speculation — emphasis on the “clearly marked”.

Clearly marking speculation and discussing what is confirmable helps other journalists and audiences make up their own minds based on the evidence they are seeing.

I tried to ensure, however, that I continued linking to the basis for my speculation. Twitter allows selective retweeting, and #ttrttpt (or my preference, #rpt) doesn’t always follow.

At that point, new information started appearing in local media. Since reasonable French and passable German are among my languages, I was able to verify the information about the pilot being arrested.

Learning point: there comes a point in many stories where translation is needed — whether between languages, as here, or between technical information and jargon-free understanding. There is firmly a role for “translators” in the news process.

As I scoured the #ET702 hashtag, which was rapidly diminishing in usefulness as it trended and became the target of spambots, it became clear that local media had local sources — and that they were best placed to continue the story. Also, it was nearly 2am in my timezone.

However, there is still a clear role for specialist media to provide specialist information and clarification to media. This is a clear bugbear among my specialist colleagues, as you can see from the number of favorites this tweet got:

This is a consistent failing of the general media, and it would be so easy to avoid by creating a culture where specialist expertise is valued, or creating a mechanism to acquire or use that expertise quickly.

Just one example, on a Facebook backchannel used by the passenger experience community of journalists, observers, analysts and industry professionals.

Learning point: specialist media and specialist media relations people judge generalist media harshly when basic stuff like this is wrong. If you can’t get this detail right, what hope is there for the rest of your piece?

I was also fielding a fair few questions about what squawking and “7500" were all about, so I made sure to refer to it for reference overnight as I got ready to sign off.

As I started winding down, I also pointed people to specialist outlets that were keeping their stories fresh (including two who were on west coast time).

And that was it for the night.

Two days later: reflections on the process

The followup from #ET702 and my role in breaking the news has been truly fascinating. There are clearly numerous ways in which my experience as someone well-placed for this story will — and won’t — be relevant to other breaking news stories.

I’m continuing to develop my thoughts on the lessons that media, industry experts, analysts, social media participants, geeks and observers can learn from #ET702. I’d welcome thoughts from across the spectrum: you can get in touch with me at john@walton.travel any time.

I’m sure I’ll also be talking more about it on Twitter (yes, I’m @thatjohn, in case you hadn’t figured it out). For more about me, see walton.travel.

I’ve been very grateful to numerous colleagues and friends for taking the time to mull over conclusions in various forms, particularly Mary Kirby of the Runway Girl Network, David Parker Brown at Airline Reporter, Cynthia Drescher at Jaunted, and Chris Shipley at the Reynolds Journalism Institute at the University of Missouri, where I will be speaking on my experience next week.

Further reading on the topic, some of which I contributed to:

  1. How the Ethiopian Hijacking Hit Twitter and Became a Social Media Emergency Lesson on Jaunted
  2. How Social Media is Shifting Breaking Stories Around the World on Airline Reporter
  3. #ET702 and the birth of real-time journalism by Chris Shipley at the Reynolds Journalism Institute
  4. Ethiopian Airlines Hijacking to Geneva — Lessons in social media crisis management from Simpliflying

--

--

John Walton

Aviation journalist, travel columnist, interiors expert, plane chap. #PaxEx #avgeek, A340–600 fan, wanderer, tenor, linguist, big gay sort-of-Brit.