On the 19th of May 2016, an Airbus A320 en route from Paris to Cairo disappeared from radar at cruising altitude over the Mediterranean Sea, spiraling to its doom from 37,000 feet until it was dashed against the night-black water. What caused the loss of the EgyptAir flight and its 66 occupants should have been uncovered by a straightforward inquiry, but instead, the case quickly evolved into one of the more unnerving and unnecessary mysteries of 21st century aviation. The problem wasn’t that investigators couldn’t find the cause — it was that not all of them seemingly wanted to.
Four months into the Egyptian-led investigation, Egyptian and French experts erupted into a public dispute over whether the crash was an accident at all. Was EgyptAir flight 804 brought down by a bomb, as Egypt announced, or had a fire erupted in the cockpit, as French investigators still believed? Before the question could be properly resolved, the investigation was taken out of the hands of the accident investigators, and the regular updates suddenly fell silent. And for eight years, the crash remained an uncomfortable mystery.
That is, until now.
In October 2024, Egypt unexpectedly released a 663-page final report containing not only its own arguments in favor of an intentional explosion, but also a nearly complete French report arguing for a cause that was totally different — and frankly much scarier. Although not everything contained in this massive release is convincing, and some of it appears to be plainly untrue, these two reports contain a treasure trove of previously unseen evidence that nevertheless sheds a substantial amount of light on what happened on that fateful night over the Mediterranean, and a careful reading reveals a probable story of the demise of flight 804 — a story that can now be told for the very first time.
◊◊◊
This article is one I thought I might never write. I’ve been writing about plane crashes in some capacity for 7 years, and EgyptAir flight 804 has been hanging over my head throughout that entire time period, still unsolved. It’s a relief to be able to say, by the end of this article, what most likely happened.
That said, this story is as much about how we almost didn’t get the truth as it is about that truth itself. For that reason, the storytelling format in this article is different from my others. Instead of telling the story of the flight and then analyzing significant moments, I’ve organized the information in the order that it first became known to the public, culminating with the release of the final report and the revelations contained therein, in order to provide context for how we ended up with two competing reports released 8 years after the accident, only one of which makes any sense. As such, the table of contents is as follows:
Part 1: Flight 804 is Missing — Events immediately surrounding the accident.
Part 2: Cold Case — The investigation enters a frozen state.
Part 3: Explosive Evidence — Analyzing the contents of the Egyptian report.
Part 4: Inferno — Analyzing the contents of the French report.
Part 5: I Ask Forgiveness from God — Possible narrative of the accident.
Part 6: A Legacy to Be Written — Conclusion and next steps.
This article also contains citations in the format [Ref #:Page #-#]. See the article endnotes for a link to the bibliography.
◊◊◊
The time was approximately 2:25 in the morning at the high altitude Athens Area Control Center in Athens, Greece, callsign “Athena.” The overnight shift was on duty, monitoring en route traffic over mainland Greece and adjacent portions of the Mediterranean Sea, aircraft identification blocks drifting steadily across radar screens. Even in the dead of night, Athena never slept.
In the Athens Area Control Center’s sector 5, a steady flow of communications lit up the controller’s radio.
“Sky Travel 2512, contact Cairo 127.7, bye bye.”
“Roger Athena, bye bye, Athena, Sky Travel 2512.”
“Radar, Gulf Air 006, good morning.”
“Good morning 006, radar contact, flight level 410 to MAGIS.”
“Thank you.”
“Air France 4320, hello, radar contact, 370 RUGOS.”
“To RUGOS.”
“Ethiopian 706, continue present heading.”
“Present heading Ethiopian 706.”
“Ethiopian 502 contact Macedonia radar 133 decimal 575, bye bye.”
“133, 575, bye.”
“EL AL 388 contact Nicosia radar 125.5 Kali.”
“125.5 Kalimira…” [2:437–439]
Near the bottom of the radar screen, an EgyptAir flight was approaching the handoff point to the neighboring Cairo ACC, at an imaginary GPS waypoint called KUMBI. The controller hailed it with the handover instructions.
“EgyptAir 804, contact Cairo 124.7, bye bye.”
But there was no reply.
After eleven seconds, the controller repeated, “EgyptAir 804, contact Cairo 124.7.” Another 15 seconds passed in silence. “EgyptAir 804?” the controller asked.
Four more times, the controller called flight 804, only to be met with silence. The aircraft’s radar return was still on the screen, still displaying its cleared cruising altitude of 37,000 feet, proceeding on course. [1:153]
Athena called Cairo to ask whether the aircraft was already in contact with the next sector. The answer was negative. Athena and several nearby aircraft then tried to raise flight 804 on the emergency frequency 121.5, without success. [1:153]
And then flight 804’s radar return abruptly disappeared. There had been no distress call, no sudden loss of altitude, no emergency code transmitted. It was simply gone.
Within three minutes, Athens area controllers notified the Hellenic Air Force that they had lost radar and radio contact with a passenger plane, and by 2:48, the aircraft was declared officially missing. [1:154] There was no longer any doubt: an Airbus A320 with 66 souls on board had surely gone down somewhere in the eastern Mediterranean. It was the start of what promised to be a long and complex story, but no one that night yet knew just how fraught that story would be.
◊◊◊
Before the first piece of wreckage had been located, before the first ships had even reached the aircraft’s last known position, phones would have been ringing at the headquarters of the Egyptian Aircraft Accident Investigation Directorate, or EAAID, the civil agency responsible for investigating incidents and accidents on Egyptian territory or involving Egyptian aircraft. As a signatory of the Chicago Convention on Civil Aviation, it was Egypt’s right and responsibility to lead the investigation into the loss of flight 804 under the principles of the Convention’s Annex 13, which holds the aircraft’s state of registration responsible for determining the cause of an aircraft accident in international waters. [3:32]
This was not the first time that an EgyptAir flight had crashed at sea, outside any state’s sovereign maritime territory. In 1999, when EgyptAir flight 990 plunged into the Atlantic Ocean 100 kilometers off Nantucket Island in the United States, Annex 13 permitted Egypt to lead the investigation, but due to the crash’s relative proximity to America, Egypt decided to delegate the leadership role to the United States National Transportation Safety Board. That was a decision that many in the Egyptian government came to regret when the NTSB concluded that an EgyptAir first officer had crashed the plane into the ocean on purpose, taking 217 people with him — an accusation that many Egyptians still consider outrageous and embarrassing. [4][6]
This time, however, the crash site was off Egypt’s own coast, and there was no question that Egypt would — and should — lead the investigation. But that didn’t mean they would do so alone. Annex 13 obligates the state of occurrence to invite accredited representatives from several other states, including, if applicable, the state of registry, the state of manufacture of the aircraft, and the state of manufacture of the engines. [3:37] Because the Airbus A320 was manufactured in France and was fitted with American engines, the French Bureau of Inquiry and Analysis (BEA) and the American National Transportation Safety Board (NTSB) were invited to participate by sending accredited representatives. Both agencies announced that they would send such representatives, along with support staff from the European Aviation Safety Agency and Airbus. [5:506]
The following day, as international investigators began to arrive, only the barest outline of the flight was known. EgyptAir flight 804 had departed Charles de Gaulle Airport in Paris, France at 21:21 UTC, bound for Cairo, with 56 passengers and 10 crewmembers on board. The crew consisted of two pilots, five flight attendants, and three security officers to deter hijackings. There had been no reports of any abnormality, and the flight appeared to be on course when it suddenly vanished. But besides these facts, little else could be said.
Within a short time, however, search ships from several countries began to encounter floating debris and human remains on the sea surface near the aircraft’s last known position. [6] The wreckage was badly fragmented, suggesting a high speed impact. [5:528] But the first major clue was discovered not at the crash site, but back in Cairo, when it emerged that the airplane had broadcast a series of fault messages and warning indications to EgyptAir’s maintenance facility via the Aircraft Communication Addressing and Reporting System, or ACARS. [7]
ACARS is a satellite- or radio-based communication system that allows flight crews to exchange textual information with ground-based airline personnel while in flight, [8] but it can also function as a maintenance tool, scooping up any reported system faults and broadcasting them automatically to an airline’s maintenance headquarters in order to help mechanics start diagnosing a problem before the aircraft even arrives. [1:79]
As it turned out, flight 804 sent several alarming ACARS messages in the minutes before it crashed. At time 00:26 UTC (02:26 local), the system registered a “lavatory smoke” warning, followed over the next three minutes by a fault with the right cockpit window anti-ice system, a fault in the right sliding cockpit window sensor, smoke in the avionics bay, a fault with the right fixed cockpit window sensor, a fault with the №2 flight control unit, and finally a fault with spoiler-elevator computer №3. [1:80] These systems had no obvious commonalities except that all of their power supplies passed through a common panel in the aft right part of the cockpit. [1:224]
The fact that multiple unrelated systems failed sequentially, accompanied by smoke alarms, represented compelling evidence that there had been a fire on board the aircraft at some point after it stopped responding to radio calls at 00:25 UTC. But these messages did not explain the cause of the fire, nor did they provide any means with which to determine whether the fire was the cause of the accident, or whether the event that caused the accident also happened to result in a fire. And until that question could be answered, anything was possible.
◊◊◊
In the first 24 hours after the crash, officials in both the US [10] and Egypt [9] openly hypothesized that a bomb might have brought down the aircraft — a theory that was not entirely unfounded. Just under 7 months earlier, ISIS terrorists planted a bomb aboard a Russian airliner departing from Sharm-el-Sheikh, Egypt, claiming 224 lives. Furthermore, flight 804’s sudden disappearance from radar at cruising altitude without a distress call drew comparisons to previous bombings, where such disappearances were caused by the immediate destruction of the aircraft in flight.
However, investigators were already becoming aware of evidence that complicated the assumption that the aircraft exploded at cruising altitude.
Days after the crash, [11] a review of radio data revealed that a signal was received from the aircraft’s Emergency Locator Transmitter (ELT) at 00:36:59 [1:247], just over seven minutes after the plane disappeared from radar screens in Greece and Egypt — leaving a gap that was suspiciously long if one assumed the aircraft had broken up.
The type of ELT fitted to most modern airliners, including the accident aircraft, is designed to transmit an automated distress signal when the device is subjected to a certain level of longitudinal deceleration (in this case, between 2.0 and 2.6 G’s). [1:116] Two G’s of longitudinal deceleration refers to a reduction in forward velocity that causes objects inside the aircraft to jerk forward with an apparent force equal to twice that of earth’s gravity. The level of deceleration required to impart such a force is high enough to represent a relatively reliable indicator that the airplane has crashed. Therefore, it seemed reasonable to assume that the activation of the ELT represented the time at which the aircraft impacted the sea.
However, raw Greek radar data showed that there was more to the story. When a plane disappears from modern air traffic control radar, that only means its transponder has stopped broadcasting — it doesn’t mean that the aircraft isn’t still flying. That’s because ATC radar is what is known as “secondary radar,” which interrogates an aircraft’s transponder in order to receive detailed information about that aircraft’s identity, altitude, airspeed, and more. It’s not what the average person pictures when they imagine a radar dish bouncing radio waves off a solid object in the sky. That type of radar is called primary radar, and it’s no longer used for ATC purposes because it doesn’t provide any useful information about the target, except for its rough location. But it does exist, and it’s usually recorded — and in this case, it captured something surprising. The data showed an object, clearly flight 804, continuing past the point where the transponder was lost, before entering a tightening right-hand spiral that continued until the last radar return was received at 00:38:50 — one minute and 51 seconds after the ELT signal was generated, and nearly nine minutes after the loss of secondary radar contact. [1:151–152]
The fact that the ELT transmitted a distress signal before the plane hit the water was difficult to explain, and the question of how it happened could not be immediately resolved. Some possible reasons will be examined later in this article. But the presence of a single target following a spiral flight path on primary radar clearly showed that the aircraft did not break up at 37,000 feet, but rather continued to fly, or at least fall in one piece, for nine more minutes. Nevertheless, what took place during those nine minutes remained a complete mystery.
◊◊◊
The only way for investigators to understand these scattered scraps of evidence was to find the wreckage, and especially the flight recorders, which were equipped with battery-powered transmitters known as “pingers” that signal the box’s location when submerged in water. Using the location of the ELT signal and the last recorded radar data, BEA investigators identified a search area, and the French vessel Laplace was brought to the scene to locate the pingers. [1:181] Around the first of June, such signals were in fact detected on the seabed — but this discovery only identified the probable wreckage area. [12] Finding and recovering the debris required the services of the specialized search ship John Lethbridge, which arrived in the area only on the 10th of June, equipped with side-scan sonar and a remotely operated deep sea salvage vehicle. [1:181–182] The wreckage field was conclusively identified using sonar on the 14th of June, and early the following morning, a deep sea ROV captured the first footage of the debris, lying scattered on the ocean floor at a crushing depth of 3,000 meters — only 800 meters less than Titanic. [12]
The recovery of the black boxes was swift. The first recorder was found on June 16th, and the other was retrieved the next day, whereupon the devices were rushed to Alexandria. The flight data recorder (FDR), which captured hundreds of aircraft parameters, promised to shed light on the origins of the fire, while the cockpit voice recorder (CVR) would reveal the context in which the fire started, and the response of the crew.
But before either device could be decoded, specialized repairs had to be made to correct impact damage to the memory boards, which threatened to derail the investigation. These delicate repairs couldn’t be made with the available equipment and expertise at the EAAID headquarters in Cairo, so the recorders were shipped to France and restored to working order by the BEA. [1:166, 176] But in the end, despite lingering doubts about the survival of the data, the BEA was able to extract the contents of both recorders, before returning the downloaded information to the EAAID.
Later, after the investigation broke down into acrimony, an anonymous investigator told French newspaper Le Figaro that the Egyptians instructed the BEA to erase all local copies of the black box data. [13] While I couldn’t independently verify these claims, it is true that Egypt possessed wide latitude to control the distribution of these recordings under Annex 13, which specifies that “The State conducting the investigation MAY leave the original recordings, or a copy of them, with the read-out facility until the investigation is completed, in order to facilitate the timely resolution of additional requests or clarifications, providing that the facility has adequate security procedures to safeguard the recordings” (emphasis added). [3:64] Because this provision gives the leading state (in this case, Egypt) discretionary authority to permit another state to keep copies of the recordings, it is implied that the leading state can also withhold such permission without any specific reason. The anonymous source told Le Figaro at the time that the BEA destroyed all of its own copies of the data in order to comply with this provision of Annex 13 [13], but as we’ll see later, that wasn’t actually true. So hold that thought.
In the meantime, representatives of the EAAID, BEA, EgyptAir, Airbus, and other parties to the investigation reviewed the flight data and listened to the cockpit voice recording. We’ll get to the details of what they saw and heard later in this article. But what was publicly released at the time, in one of the last significant investigative updates, was that the CVR confirmed the already suspected outbreak of a fire aboard the aircraft. [14]
Back at the crash site, other discoveries added weight to these findings. The deep-sea ROV was deployed several times to bring wreckage to the surface, ultimately recovering 21 items of interest before its mission came to an end. [1:185] Among these items was one particularly interesting piece of the outer fuselage skin that had once been installed below and behind the right forward passenger door. The skin section, crushed and mangled by the impact forces, showed clear signs of exposure to fire, such as sooting and charring, on its interior side. Similar markings were found on a structural element that once supported the ceiling over the galley entryway area. [1:234–236] The discovery of fire damage in this area was consistent with the ACARS fault messages, which indicated a series of system failures on the right side of the cockpit.
Public speculation about the cause of the fire in the cockpit mostly focused on possible electrical failures or the combustion of a battery-powered device, such as a cell phone. But behind the scenes, another theory was brewing — one that would tear the investigation apart.
From the very beginning, investigators had seriously considered the possibility that flight 804 was brought down by an intentional explosion, despite the fact that no claims of responsibility had been forthcoming. But the speculation about this possibility came mostly from the Egyptian side, from figures like the chairman of EgyptAir [15] and Egypt’s aviation minister [12]. Terrorism had not been officially ruled out, but by the end of the summer, European analysts believed an accidental fire was more likely.
However, on the 16th of September, French newspaper Le Figaro reported that traces of the high explosive TNT had been found on the remains of several crash victims. [13][16] Although some remains were found floating on the surface and others were recovered from underwater, the initial reports did not clarify to which group these remains belonged. But according to Le Figaro’s source, the French investigators wanted to study the remains’ chain of custody in order to rule out potential post-crash contamination — only to find these efforts stymied by the Egyptian judicial authorities. The source close to the investigation further stated that the remains had been packed in bags supplied by Egypt and that the French side didn’t know where the bags came from. It was also alleged that Egypt wanted to draw up a joint Egyptian-French report confirming the presence of TNT but that France had refused. [13]
Despite the lack of French cooperation, Egypt eventually decided to move ahead. On the 15th of December, the EAAID publicly stated that TNT had been found on the victims, while the Civil Aviation Authority announced the opening of a criminal investigation. Furthermore, with a criminal act officially suspected, Egyptian public prosecutors were legally obligated to take over the investigation. Nevertheless, a source close to the French investigation told BBC News that they had doubts about the validity of the explosive traces. [17] With this doubt still lingering, the BEA was likely suspicious of the move to take the investigation out of the hands of the EAAID, which would also stymie their own efforts to assist the Egyptians. Once the investigation is transferred to the law enforcement system, Annex 13 no longer applies, and the involvement of the aircraft’s state of manufacture is no longer protected, effectively freezing France out of the process.
◊◊◊
After the investigation was taken out of the hands of the EAAID, Egypt stopped releasing updates on the crash of flight 804. Month after month passed with no word. No suspects were named and no one was arrested. It was as though the door had been slammed shut in the face of the public.
After December 2016, all notable updates on the crash came from European sources. The first noteworthy report surfaced in May 2017, when a source close to the investigation told various media that French forensic experts had searched for explosive traces on the repatriated remains of French nationals, but had found none. These tests were apparently performed in connection with an ongoing manslaughter investigation into the crash by France’s judicial authorities. [18]
The manslaughter investigation was opened shortly after the crash in order to ascertain whether a crime had been committed resulting in the death of French nationals, which is standard procedure in France in the event of an air disaster. But this investigation was also unbound by the principles of Annex 13, and sometime in 2018, this resulted in a spectacular confrontation between the judicial authorities and the BEA. According to French newspaper Le Parisien, the French justice department sought to retrieve the black box data from the Egyptians, but was told that the data was still held by the BEA, despite previous reports that the agency had destroyed all its copies of the data. Under Annex 13, the contents of the flight recorders were the privileged property of Egypt, and the BEA did not believe it had the right to turn over the data to the justice department even if it had a copy. But French law contradicted this, and not only that, the justice department learned that such a copy did in fact exist. Allegedly, a copy was automatically created when the data was downloaded, which the BEA refused to hand over, citing Annex 13. In response, the justice department issued a search warrant, and French air transport gendarmes raided the BEA headquarters in October. [19] When asked for comment, a BEA spokesperson told Le Parisien, “We are complying with international law. It is up to the Egyptians to communicate the elements. And this agreement with the French justice system only works if it is the BEA that directs the investigation into a crash. … When we deciphered the black boxes, the data was handed over to the Egyptians and everything was erased. But we later discovered that an automatic backup had been done. We didn’t know” [19]. Separately, a BEA spokesperson told the Wall Street Journal, “We are not allowed as [the] BEA to release to third parties any information on this safety investigation because we are not leading it. The Egyptian authorities are, and they need to approve that kind of request.” [20]
Although tangential to this story, a police raid on an investigative authority in order to seize crash data is completely unprecedented to my knowledge, and raises questions about the way international investigations are handled. The BEA probably saw itself as bound by an international treaty under which it had no authority over the flight recorders, while simultaneously bound by French domestic laws that did not protect it from being subpoenaed. If the BEA was aware it possessed a copy of the data, then it was stuck between a rock and a hard place. But the full story of how the BEA came into possession of the flight data backup and how it handled the resulting conflict with the justice department has not been publicly revealed.
For another three years, the manslaughter investigation dragged on, until in 2022 a dossier was submitted to the Paris Court of Appeals containing further conclusions. This dossier was seen by Italian newspaper Corriere della Sera, which published an article summarizing the findings. Much of the article’s contents had not previously been made public. I won’t go into the details here, but in broad strokes it stated that an oxygen mask was leaking oxygen in the cockpit, possibly due to an incorrect setting, and the leak may have been ignited when one of the pilots lit a cigarette. The report alleged that EgyptAir pilots smoked so regularly that the airline recently had to replace the cockpit ashtrays. However, the original article didn’t point to specific evidence that the accident pilots were smoking at the time of the fire, a fact that was lost in some second-hand reporting. [21]
The article in Corriere della Sera received quite a lot of attention in the aviation community and even led to the filming of a documentary on the crash for the long-running TV series Air Crash Investigation (also known as Mayday), in which experts debated the theory put forward by the article and called for further investigation. However, the consensus among industry watchers by that time was that a definitive report was unlikely to be published as long as Egypt refused to cooperate. In a chatlog dated October 2022, I myself said, “Maybe one day there will be a regime change in Egypt, and then ten years later the investigative authority [will] quietly upload a ton of old reports on some random Wednesday.”
It has to be said that by 2022, with over 6 years having passed since the crash, the normal timeframe for completion of an accident report had long since come and gone. The average report is completed in one to two years; sometimes three; occasionally four. By the time six years had passed, experts were starting to get agitated — and angry. If the fragments of evidence about a cockpit fire were true, then it was possible that there was some vulnerability in the design of the Airbus A320, which is on track to become the best-selling passenger jet of all time. As a result, in October 2022, analysts Nicholas Butcher and John Cox with the Royal Aeronautical Society published an article calling on Egyptian authorities to release an accident report, writing that “Six years of not knowing the circumstances surrounding the loss of one of these widely used Airbus aircraft is simply unacceptable.” [22] This call was echoed by others.
In their article, Butcher and Cox also included a telling line: “It is understood that the French BEA have attempted to persuade the Egyptian authorities to publish an accident report without success.” [22] Although the claim was unverifiable at the time, it is now known that the BEA was indeed pressuring the Egyptians behind the scenes to continue the investigation. However, the EAAID indicated that the matter was out of its hands. [5:502]. Apparently concerned that the case would remain frozen as long as the ball was in Egypt’s court, the BEA took the extraordinary step of organizing a completely independent testing and analysis regime in order to elucidate the causes and propagation methods of the fire, using only the evidence Egypt had already given them. These tests were conducted throughout 2023 and the results were submitted to the EAAID in October of that year. [23:659]
Sometime prior to July 2024, a decision must have been taken within the Egyptian government to allow the EAAID to publish a final report, because the BEA was able to view a draft report, and its comments on that report were submitted on the 31st of July 2024. [23:643] The EAAID’s response to those comments apparently prompted the BEA to submit a revised version of its October 2023 submission, which was received by the EAAID on the 24th of October, 2024. Six days later, with no prior announcement, the EAAID released its final report with the French report appended — and just like that, the story of EgyptAir flight 804 was released from its frozen stupor, nearly eight and a half years after the A320 plunged into the Mediterranean.
Unfortunately, the BEA and the EAAID didn’t come to an agreement about the cause of the crash. In fact, their reports could hardly be more different. The Egyptian report concludes that the aircraft was brought down by an intentional explosion in the galley, while the French submission argues for the accidental ignition of a component within the first officer’s oxygen mask stowage box, resulting in an unstoppable fire. This divided result is likely to sow confusion and confound interested parties, especially those who lack any specialized knowledge of aviation. But, much like my previous study of Arrow Air flight 1285, reading both reports and comparing them to investigative best practices has revealed that only one holds up under scrutiny.
What follows in Part 3 is a point-by-point analysis of the Egyptian findings. I engaged in consultations with professionals in the field prior to writing this section, but for legal reasons those people will remain nameless and all opinions put forward hereafter should be considered my own except where otherwise indicated.
◊◊◊
The crash of EgyptAir flight 804 took place against a background in which Egyptian aviation was under explicit and implicit threat from various groups and individuals, including but not limited to the Islamic State, whose operatives were active in Egypt’s Sinai peninsula. In addition to the Russian airliner that was destroyed by a bomb over the Sinai in October 2015, an EgyptAir flight on March 29th, 2016 was hijacked by a man wearing a fake explosive vest, who forced it to divert to Cyprus. [24] No one was killed or injured in the incident, but the hijacking less than two months before the crash may have been why there were three security officers aboard flight 804. Nevertheless, no specific threats had been lodged against the accident flight, and there was no indication that there was anything abnormal about any of the passengers or crew. It should however be noted that identifying possible perpetrators was not part of the EAAID’s mandate, and the report contains no discussion of suspects, motives, or methods.
After departing Charles de Gaulle Airport at 21:21 UTC, flight 804 climbed normally to its cruising altitude of 37,000 feet, or flight level 370, and proceeded southeast in the general direction of Greece. The cockpit voice recording began as the aircraft was cruising over the Adriatic coast about two hours before the accident, capturing mainly personal conversations between the pilots. [2] Light music was playing in the background. [2:440]. The First Officer, 25-year-old Mohamed Assem, was the pilot flying; 36-year-old Captain Mohamed Shokair was monitoring the instruments. [25][1:23,26][5:583] At around 00:04, Captain Shokair apparently received lasagna and asked for a toothpick, after which the conversation died away. For several minutes the cockpit voice recorder captured only the steady chatter of other aircraft communicating on the Athens radio frequency. At around 00:21, Captain Shokair asked a flight attendant for a blanket and pillow because he was feeling cold, and the flight attendant returned with those items at 00:23. First Officer Assem then proposed that she sit in the observer seat, and she assented. The CVR captured the sound of the folding cockpit observer seat being deployed, but no further conversation took place. [2]
Moments later, at time 00:25 and 24 seconds, the EAAID believes an explosive device detonated in the forward galley.
◊◊◊
Before we dive into the EAAID’s basis for this scenario, it’s helpful to briefly examine some of the methods that investigators normally use to identify a high explosive detonation aboard an aircraft.
To start us off, I retrieved a copy of a 1973 US Air Force document entitled “Fire and Explosion Manual for Aircraft Accident Investigators.” Investigators today certainly have access to more up-to-date manuals, but this is what was publicly available, and the basic theory hasn’t changed that much anyway.
In broad terms, the manual states, “In the fire or explosion analysis, it is necessary to account for the source of the combustible, the probable source of ignition, the history of the fire, and the observed fire damage. Any assumptions that are made must be reasonably consistent with the evidence on system malfunctions, material failures, and the sequence of events” [26:5]. Hopefully all of this goes without saying. Next, the manual reads, “The origin of the fire is deduced from a combination of the evidence developed in determining the sources of ignition and combustible [material] and the material failures or system malfunctions” [26:7]. And lastly I want to highlight the following line: “Damage from explosions is usually indicated by the rupture of an aircraft compartment and the dispersal of fragments” [26:8].
Next, I examined two famous aircraft bombings — Pan Am flight 103 and Air India flight 182 — in order to analyze the types of evidence that were used by accident investigators to prove the detonation of a high explosive.
The British AAIB report on the bombing of Pan Am flight 103 over Lockerbie, Scotland in 1988 is almost entirely dedicated to analyzing the breakup pattern of the aircraft in order to establish the origin and nature of the initiating event. In that case, investigators scoured the Scottish countryside to retrieve as much wreckage as possible and reassembled it in order to more easily identify damage patterns. Consequently, investigators were able to identify a so-called “shatter zone” where the fuselage fragments were reduced to a very small size or were not found. Surrounding this area was a “starburst pattern” of larger skin sections that were torn away and curled outward, while their interior faces were pitted and soot-covered. [27:19] The report also described the recovery of numerous fragments of a forward baggage compartment that all showed evidence of close proximity to an explosive detonation [27:22], as well as extensive discussion of how the explosion-induced fractures propagated through the aircraft. [27:25].
In the case of Air India flight 182, the investigation report produced by the High Court of Delhi includes detailed descriptions of various explosive signatures, including numerous small punch-through holes in the fuselage skin with high-energy impact characteristics [28:106]; small pieces of metal curled in upon themselves by more than 360 degrees [28:107]; a large number of tiny fragments trapped inside larger pieces of wreckage [28:108]; greatly different damage in the forward cargo hold vs the aft [28:170]; distinct metallurgical markers on the fracture surfaces, with photographs [28:100, 171]; replication of damage patterns during experimental explosions [28:110–111]; and circumstantial evidence, including a suspicious person who asked for his baggage to be forwarded on Air India flight 182 without boarding the aircraft himself; and the explosion of another bomb originating from the same airport on the same day, in a bag associated with a reservation made by the same person who failed to board flight 182 [28:160–163]. It should be noted that the Air India report contains discussion of the perpetrators, while the Pan Am report does not, because Air India flight 182 was investigated by a court inquiry, whereas Pan Am flight 103 was subject to separate safety and criminal investigations, of which only the former is cited here.
The Air India report also includes testimony from an expert who had reviewed numerous aircraft explosions between 1946 and 1985. According to this expert, the most reliable indication of an explosion is “cratering” of nearby metals, consisting of “minute and numerous” indentations, “often in groups.” “Fusing of metal, scorching, pitting, and blast effect” were cited as good indicators, while “curling, corkscrewing, and sawtooth edges” could be explosive indicators in conjunction but are not always adequate proof by themselves. [28:111–112] Regarding curling of metal, the expert added, “Curling petals … may be observed in other events than explosions…. It is probable that these features indicate a rapid rate of failure but not necessarily of a rapidity which could only be produced by an explosion” [28:108].
Keeping all this in mind, let’s consider the arguments used by the EAAID to support its hypothesis that an explosive device detonated on flight 804.
◊◊◊
The development of the bomb hypothesis appears to have begun with the recovery of the victims’ remains, which was conducted in three stages dated 22 May, 25 June, and 4 July. Bizarrely, the EAAID included an annex containing a detailed and often morbid description of each shred of human tissue that was recovered [29:465], which is certainly not standard procedure in an investigation report. The annex also describes “strange plastic or metallic parts” embedded in some of the remains, although as far as I am aware this is normal in a high speed aircraft crash. The aircraft and its occupants were both torn to shreds and mixed together; physics does not discriminate.
According to the report, French and Egyptian experts analyzed the first group of remains aboard the John Lethbridge and then transferred 23 of them to Cairo, where six tested positive for TNT and other compounds associated with a TNT explosion. These remains were found at the crash site within 3 days of the accident, which means they were floating on the ocean surface. Subsequently, the report states that additional remains from the 25 June group were examined; some of these remains showed evidence of burning, which must have taken place in flight. [29:484–485] The report doesn’t say how many of these tested positive for TNT, but it does say that a total of 23 samples belonging to 18 individuals showed traces of the explosive, and the remains from the 4 July group weren’t tested. [1:269]
The aforementioned annex contains a table showing which samples belonged to which individual, along with which ones tested positive. Horrifyingly, the copy of the report originally submitted to the BEA for comment didn’t redact the names of the victims from this table, which is a massive breach of confidentiality that the experts I spoke with agree amounts to malpractice. Fortunately, the EAAID redacted the names before publishing the report, but only because the BEA told them to. [29:486–493][23:659]
In any case, these data appear to support one of the purported findings of the French judicial report from 2019; namely, that some of the TNT traces were on remains that should have been underwater long enough to dissolve any residue. The 25 June group of remains was recovered from the sea floor more than a month after the crash, but according to the Federal Aviation Administration, explosive residues should dissolve after only 2 days of total immersion in seawater. [30] Considering this fact, there is good reason to doubt that the TNT traces originated from an explosion on board the aircraft. Cases of cross-contamination after recovery have occurred in the past, and French investigators appear correct to be skeptical of the findings.
In its report, the EAAID reveals some previously unreported or underreported details about what happened to the investigation after it was handed over to the judicial authorities, which may explain how these findings were accepted uncritically.
Following the forensic medicine authority’s discovery of TNT traces, the Egyptian public prosecutor’s office assigned the investigation to a so-called “Triple Committee” consisting of a forensic evidence expert, an aviation expert, and a forensic medicine expert. This committee confirmed that several pieces of wreckage from the forward right side of the aircraft had been subjected to fire and smoke, but all the items tested negative for explosive residue. The committee’s report indicates that this could be because the parts had been under the sea for too long, causing the residue to dissolve. [1:217] However, it has to be noted that these parts were recovered at around the same time as the June 25 group of human remains [1:185], and the report doesn’t address why the human remains would still contain explosive traces while the wreckage did not.
We’ll come back to the rest of the Triple Committee report in a moment, but first I want to wrap up the discussion of explosive residues. Throughout the Egyptian report, there are dozens of references to TNT and traces of explosives, and the presence of these traces appears to be central to the EAAID’s findings. But this stands in stark contrast to the reports on Air India flight 182 and Pan Am flight 103, each of which contains only one reference explosive residue. In the Air India report, an expert providing testimony makes an offhand reference to sending a component for chemical analysis [28:107–108], and the presence or absence of explosive residue was not used in formulating the analysis or conclusions. [28:158–171] Similarly, the only reference to explosive residue in the Lockerbie report is an offhand mention in a paragraph describing how the interior faces of the fuselage panels near the bomb were hit by a “cloud of shrapnel, unburnt explosive residues, and sooty combustion products.” [27:46] Furthermore, the 1973 Air Force investigation manual makes no reference to chemical analysis of residues as a technique for identifying an explosive detonation aboard an aircraft. However, this could be because the manual was intended for military investigations involving aircraft that are often carrying ordnance as part of their normal cargo.
Lastly, it must be mentioned that the EAAID report contains, on page 270, a chart showing the seating locations of the passengers and crew whose remains tested positive for TNT (shown above). But rather than being concentrated near the area where the explosion allegedly took place, at the front of the cabin, these individuals are scattered throughout the aircraft with no apparent pattern. Furthermore, those occupants seated nearest to the alleged blast site did not test positive. [1:270] It’s possible that these passengers’ remains were all recovered in the 4 July group, which was not tested for explosives, but this is improbable. The report does not explain why the distribution was seemingly random.
Overall, it appears that the presence of explosive residue is not normally used to prove that an explosive device detonated aboard an aircraft, and my impression is that it was inappropriate as a starting point. In both previous bombings discussed in this article, testing of residue was presumably undertaken by police investigators in order to identify the type of explosives involved, for purposes of finding the perpetrators, but it was not used by the safety investigations to determine the cause of either crash. In its comments on the report, the BEA also criticized the centrality of explosive residue to the Egyptian argument, writing that “The French experts involved indicated that the results obtained do not allow for a definitive conclusion regarding the presence of TNT. However, the presence of TNT is never questioned and is taken as an assumption or even as a starting point in all scenario analyses” [23:656]. I would also add that the report contains no evidence suggesting that the Egyptian investigators undertook any effort to rule out post-crash contamination of the samples as a possible reason for the findings.
◊◊◊
Of course, even if there’s reason to doubt the validity of the TNT traces, that doesn’t automatically mean that the plane wasn’t brought down by a bomb. Therefore, we need to examine some of the other arguments Egypt used to support its conclusions. And that brings us, first of all, back to the Triple Committee report.
The report submitted by the Triple Committee contained a number of findings relating to an explosion aboard the aircraft, including what it described as a “disruption” in the forward galley area, and “indications of mechanical loads and heat effects which might be a result of explosive material on five parts of the wreckage” [1:217]. The five pieces of wreckage cited here were a part of the fuselage frame above the forward passenger doors; a piece of fuselage skin from the lower right side of the cockpit; the previously mentioned piece of fuselage skin from below and behind the right forward passenger door; part of the right forward passenger door itself; and some mangled catering trolleys. [1:217] Although the aircraft didn’t break up in flight, the Triple Committee and the EAAID clearly believed that these portions of the fuselage were heavily damaged by the initial explosion, even as the aircraft remained substantially intact.
The EAAID report includes some basic analysis of all of these items. For instance, the catering trolley was found badly deformed, almost unrecognizable, having been turned inside out and flattened. Regarding this part, the report states, “The trolley tray tracks were so worn out probably due to gas wash,” without explanation. [1:233] Gas wash can be a side effect of an explosion as hot combustion gases change the appearance and properties of metal. However, the report doesn’t provide any evidence, such as photographs or surface analysis, that clearly demonstrate gas wash; nor does it explain what “worn out” means. Instead, the report says, “Two sides of two trolleys together with a part of galley composite wall stuck within (This feature is known only to result of the venting of high pressure gases and rolling over the sharp fractured edge in a direction away from the venting gases)” [1:238]. I had some difficulty understanding what was meant by this line, largely due to bad grammar, but in general terms it appears to be suggesting that the trolleys could only have been turned inside out by the pressure generated by an explosion. It is unclear how or why the EAAID ruled out impact forces as the cause of this deformation. Furthermore, in terms of reasoning for this conclusion, the report basically just says “it is known,” as though it’s common knowledge that only the venting of high pressure gases can turn a catering trolley inside out and wrap it around a piece of the galley wall. Needless to say, this is an assertion requiring proof or at least a source, but neither is provided.
