Comment by sinesha

Do you know the rational behind having override-overrides from the cockpit? For me, this only makes sense under the assumption that Prob(malicious agent who knows emergency codes in cockpit and good agents knowing codes outside ) is much smaller Prob(good agent knowing codes in cockpit and malicious agents knowing codes outside). How is this assumption justified? Under current regulations, the latter is becoming more and more unlikely. Or this could be fixed by letting the protocol to lock the door from inside the cockpit depend on an exchange with a trusted third party like air controllers. [edit: language]