Case studies
A secure audio recorder that changed nothing on the aircraft
Sixty-four audio channels, an encrypted medium, full TEMPEST certification — and the hardest requirement of all: fit inside the envelope and the interfaces of the system being replaced.
The context
- Sector
- State operator, Europe
- Platform
- Multi-crew mission aircraft
- Scope
- Mission audio recorder replacement
- In service
- 2024
On a mission aircraft, a large crew works on board and communicates constantly: intercom positions, radio channels, coordination between operators. Recording all of it is part of the mission — for debriefing, for analysis, and because what was said is part of what happened.
The existing recorder had reached the end of its life. Replacing it was not a capability project; it was an obsolescence project, which is a very different set of constraints.
The constraint: replace without modifying the aircraft
An in-service aircraft is an approved configuration. Changing the mechanical installation, the harness or the interfaces means a modification, which means an approval, which means the aircraft is unavailable and the programme is measured in years rather than months.
So the requirement was stated the other way round from a normal specification. Not "here is what the new recorder must do", but "here is the envelope, here are the interfaces, and nothing on the aircraft may change". Everything else — channel count, security, in-flight operation — had to happen inside that.
The architecture
A distributed acquisition over sixty-four audio channels, covering every intercom and communication position on board, writing to an encrypted medium — with the whole assembly designed to present the same footprint and the same interfaces as the system it replaced.
scroll
The recorder is operated from a remote control installed in another zone of the aircraft, and the recording can be replayed in flight from a laptop — so a crew can verify that what they needed was captured, without waiting for the ground.
Security, as a chain
- The medium is encrypted with AES-256, so a removed cartridge is not a disclosure.
- The system holds a full TEMPEST certification — because a recorder that protects its medium and radiates its content protects nothing.
- The operating position is separated: the control is in another zone of the aircraft than the recorder itself.
- And replay is available in flight, which keeps the verification inside the same protected perimeter instead of deferring it to a ground station.
Those four points are one requirement, not four. Security on a mission recorder is decided by the weakest link in the chain from the microphone to the archive, and the medium is only one link in it.
What it changed
The last figure is the one that decided the programme. A replacement that fits the existing installation is a maintenance action; one that does not is a modification project, with an approval, a downtime and a budget of a different order.
What we take from it
Obsolescence replacement is a discipline of its own, and the temptation is always to take the opportunity to improve everything. The requirement that mattered here was the one that looked least like engineering: do not touch the aircraft. Reading a specification for that constraint first, before the performance figures, is what makes a retrofit deliverable.