Potential Vulnerabilities of the NextGen Air Traffic Control System

Transcription

1 Potential Vulnerabilities of the NextGen Air Traffic Control System C. Giannatto 1 and G. Markowsky 1 1 School of Computing & Information Science, University of Maine, Orono, Maine, USA Abstract The FAA is well on its way to replacing the current air traffic control surveillance system with a new system known as Automatic Dependent Surveillance-Broadcast (ADS-B). As with many projects, the focus is on performance and getting the system operational, with security having secondary importance. This paper describes some of the vulnerabilities of the current proposed implementation of ADS-B and offers some suggestions on mitigating these vulnerabilities. Keywords: ADS-B, ATC, Air Traffic Control, Vulnerabilities, Safety, Air Travel 1. Introduction By the late 1930s commercial air travel was starting to become a popular mode of transportation and the volume of air traffic increased dramatically. As it became more difficult to keep track of the increasing number of aircraft in operation, the airlines developed a system of radio stations to help monitor their en route air traffic. These initial radio stations were located in Chicago, Newark and Cleveland and were the precursor to our current air traffic control system. The Bureau of Air Commerce acquired the radio stations in 1936 and in so doing formed what is considered the First Generation of ATC [1, p. 4]. This First Generation ATC system consisted of no automation and very little radar coverage. The fledgling ATC system relied on manual methods of tracking aircraft using progress strips for each flight. By the late 1950s the volume of aircraft in operation had increased to the point that manual tracking was no longer feasible. In 1959 the Second Generation ATC system was introduced, which automated many of the flight monitoring tasks through the use of computers for processing air traffic data and ground based radar to help track individual aircraft. Two years later, another major improvement to the ATC system was made when the FAA incorporated ground based equipment to interrogate a transponder located on the aircraft, allowing each air traffic radar target to be uniquely identified [1, pp. 4-5]. In the late 1960s, air traffic was again taxing the capabilities of the National Airspace System (NAS). By the early 1970s, advances in computer technology made it possible for Upgraded Third Generation development (UG3d) of the ATC system. UG3d provided a substantial improvement in both the terminal and en route air traffic control structures [1, p. 5]. Through the increased automation of controller tasks and the ability to receive timely flight tracking information, UG3d enabled air traffic controllers to safely accommodate and monitor the increasing volume of air traffic. 2. Air Traffic Control Today With the exception of the Global Positioning System (GPS) technologies introduced in the late 1990s, the current NAS infrastructure has undergone few changes since the improvements incorporated into UG3d. Currently the NAS consists of a vast number of facilities including 750 ATC installations, over 18,000 airports and more than 4,500 air navigation stations [2, pp. 1-9, 1-10]. The 750 ATC facilities are comprised of 21 Air Route Traffic Control Centers (ARTCCs), 197 Terminal Radar Approach Control (TRACON) facilities and more than 450 airport control towers [2, pp.1-9,1-10]. We note that there is a newer edition of the Instrument Procedures Handbook [3], but it does not contain much of this background information about the air traffic control system. ARTCCs are responsible for controlling en route traffic within designated control sectors, with the majority of the en route traffic traveling along designated airways at and above 18,000 feet. TRACON facilities control aircraft within a 30 nautical mile radius of the larger airports within the ATC system, while airport control towers are responsible for controlling aircraft within a 5 nautical mile radius of the airport. [2, pp.1-9, 1-10]. Current NAS aircraft position tracking (surveillance) techniques fall into three basic categories; Procedural ATC, Primary Surveillance Radar (PSR) and Secondary Surveillance Radar (SSR) [2, pp. 3-6, 3-8, 3-17]. Procedural ATC is known as a dependent surveillance technique, which means it depends on input from individual aircraft. With Procedural ATC, pilots are required to periodically report their position using radio communications, and it is predominately used for oceanic and remote area flight operations where there is little or no radar coverage. PSR is an independent and non-cooperative surveillance radar system typically used by TRACON facilities and in busy terminal areas which does not depend on any input from the aircraft. SSR is a partiallyindependent and cooperative surveillance radar typically used for en route tracking by ARTCCs, and determines aircraft position through a combination of radar target return and aircraft transponder reply when interrogated by a ground station [1, pp. 8-9]. Many of the current ATC facilities have been in service for more than 50 years. These installations, and in particular the

2 ground-based SSR and PSR radar systems, are very costly to operate and maintain. Increased air traffic, aging equipment and a desire to leverage technological advancements necessitate a comprehensive overhaul to the NAS. In its current form, the air transportation system performs adequately but it is once again approaching its capacity limits. Without a makeover, the expected growth in air traffic will likely create costly flight delays and increased flight safety hazards [1, pp. 6-7]. In response to these concerns, the FAA has begun the overhaul of the current air traffic control system and started working on the Next Generation Air Transportation System (NextGen). The primary goal of NextGen is to significantly increase the safety and capacity of air transportation operations. The upgrade requires a fundamental conversion of the entire NAS, including incorporation of satellite-based technologies for surveillance operations and the shutdown of many legacy ground-based systems currently in use [1, pp. 6-7]. A key component of NextGen is a position reporting and tracking technology called Automatic Dependent Surveillance - Broadcast. 3. ADS-B Automatic Dependent Surveillance - Broadcast (ADS-B) is a core feature of NextGen. ADS-B is a satellite-based surveillance technology that also uses aircraft avionics and ground-based systems to provide information on aircraft location to pilots and air traffic controllers [4, pp. 1-5]. The ADS-B system is automatic in that it requires no pilot or controller intervention. It is dependent surveillance because the aircraft provides input to the air traffic control system based on information derived from the aircraft s GPS receiver, which will allow for much greater position accuracy than the current radar-based system. [1, pp. 9-10]. ADS-B has the potential to improve safety through enhanced pilot and controller situational awareness, better inflight collision and runway incursion avoidance, and the ability to implement accurate ATC surveillance in remote areas with no current radar coverage. Better position monitoring accuracy should allow the air traffic control system to handle a higher volume of aircraft through condensed aircraft separation standards, more direct traffic routings and optimized departures and approach procedures. Another potential benefit of the NextGen ADS-B infrastructure is reducing overall air traffic control system maintenance and operating costs, since the new system is comprised of simple UHF radio stations that are significantly cheaper to install and maintain than the aging surveillance radar ground stations [1, p. 8]. The FAA s NextGen implementation plan includes a network of approximately 800 ADS-B ground stations, placed 150 to 200 miles apart [5, pp ] These stations will receive signals on two designated UHF frequencies; 1090 MHz and 978 MHz. Commercial and military aviation traffic flying in the high-altitude airways structure (at and above 18,000 feet) will utilize the 1090 MHz ADS-B frequency, while general aviation aircraft flying at lower altitudes will use 968 MHz. To facilitate interoperability between aircraft using different frequencies, the system incorporates a support component called Automatic Dependent Surveillance- Rebroadcast (ADS-R). ADS-R receives the traffic information broadcasts on the 1090MHz or 978 MHz links and rebroadcasts the information to aircraft on the opposite data link frequency [5, pp ]. There are many prospective benefits of NextGen and ADS-B, but there are also a myriad of impending problems that need to be addressed. The ADS-B portion of NextGen is scheduled to be fully deployed by January 1, 2020 and the FAA faces many potential problems as the components of NextGen are put into operation. ADS-B presents challenges to aviation on a number of levels including questions about the true costs of implementing the system and concerns over vulnerabilities to exploitation that do not exists in the current air traffic control system. In the following sections we will examine some of the implementation concerns and potential security risks that this new system imposes. 4. Scenarios and Concerns In this section we will begin by summarizing some of the scenarios that have already been published and analyze them. 4.1 Challenges to Implementing NextGen The successful deployment of ADS-B throughout the NAS faces significant risks and challenges [4, p. 2]. NextGen is facing cost projection overruns, resistance from aircraft owners and operators, miscalculations in the true benefits that can be realized, and security vulnerabilities. In short, there are areas of the project that have not yet thoroughly vetted. One of the greatest risks to the successful implementation of ADS-B is aircraft operator reluctance to purchase and install new avionics for their aircraft. This situation is compounded by the FAA s inability to accurately define requirements for the system s more advanced capabilities. Operators have raised justifiable concerns about changing requirements and uncertain equipage costs and benefits. The FAA has yet to fully define requirements for modifying its existing automation systems, and the specifics of how ADS- B information will be integrated into the existing system. Until the FAA effectively addresses these uncertainties, progress with ADS-B will be limited and concern over cost increases, delays, and performance shortfalls will remain [4, p. 2]. NextGen and ADS-B could also be facing significant cost overruns due to peculiarities in the program s contract specification. Specifically, the FAA decided on a servicebased contract for the program instead of the traditional

3 method of owning and operating the system. FAA officials acknowledge that the analysis used to justify the servicebased approach and cost savings was flawed but asserted that over the long term, the cost-benefit equation changes in favor of a contractor owning and operating the system. In spite of this claim, the FAA has not updated its cost and benefit analysis to support the service-based approach. This puts the program at risk of realizing minimal return on the FAA s investment and possible delays in achieving NextGen goals [4, pp. 2-3]. Another implementation issue the FAA needs to address is that of ADS-B frequency saturation in congested airspace. Since the ADS-B signal is broadcast, a large number of broadcasting aircraft could overwhelm the system in dense traffic areas. The frequency congestion problem is complex and solutions to address frequency congestion may require changes to the ADS-B baseline or equipment, which would increase the program cost. Currently, the FAA is examining potential solutions and exploring the specific changes needed for ADS-B air and ground components and existing systems [4, pp ]. 4.2 Scenarios from Darryl H. Phillips The scenarios in this section come from a website put together by Darryl H. Phillips [6] in We will just summarize some of the scenarios here. For more technical details please see [6] Scenario One: Terrorism This scenario envisions a lone terrorist coming to the United States and obtaining a light aircraft such as a Cessna 172, Beechcraft Bonanza or Piper Arrow equipped with an ADS-B collision avoidance system. He expects that the ADS-B systems installed on all airliners and some business and pleasure aircraft to automatically report the precise position and identity of the aircraft they are on twice per second. The terrorist waits for a day of poor visibility, and then he flies at low altitude and slow speed above a busy highway toward a major airport. He knows that Air Traffic Control radar will not see him because he has disabled his transponder output, thereby assuring that there will be no secondary returns nor any ADS-B transmissions. His aircraft is smaller than the tractor-trailers on the highway below, and the ATC primary radar has been programmed to eliminate highway clutter from the display. He will not be seen. The terrorist decides to target a large aircraft on its final approach when it is most vulnerable. Using the ADS-B readout to spot his target, he flies up the glideslope and directly toward the target. Even though he cannot see the airliner because of the bad weather, the ADS-B display lets him know its position within a few meters and he is able to crash his plane into the airliner killing hundreds of people. In our opinion the success of this scenario depends upon whether or not the airport has an operating Primary Surveillance Radar system. If an airport has a functioning Primary Surveillance Radar system, they would be aware of the rogue aircraft and its position, even if the rogue aircraft s transponder was turned off. The PSR is sensitive enough to detect the attacker, and ATC would divert any aircraft away from the attacker s flight path. If the full implementation of the FAA s NextGen goes into effect and the Primary and Secondary Surveillance Radar Systems are dismantled, then this is indeed a very credible threat Scenario Two: Extortion This scenario envisions a sociopath building a large model airplane and using it to crash into an airliner as a way of extorting money from the airline. Again, the idea is to use the ADS-B information as the basis of a guidance system. Aside from the cost of the model airplane, the cost for the electronics is relatively low. A GPS receiver might cost $100, a wireless LAN card under $30, and a 1090 MHz ADS-B receiver can be built from a DBS satellite receiver for under $200. With some software, one can create a guided missile for a relatively low cost. The credibility of this scenario is similar to that of the previous scenario, and is unlikely to happen at airports with an operational PSR. In order for the model aircraft to pose a substantial danger to an aircraft approaching the airport, it would need be large enough so that it would likely show up as a target to ATC. At airports without an operable PSR, this scenario is certainly plausible Scenario Three: Revenge This scenario envisions a disgruntled employee who feels cheated by the company for which he has produced many worthwhile inventions. He is about to retire and will be receiving only 60% of his current salary, while various executives receive millions of dollars based on the products that he has created. He decides to revenge himself against the company by making the executive jets that belong to the company crash. Since the various signals are not encrypted he is able to learn all of the ID numbers of the company planes. This disgruntled employee then waits for bad weather and spoofs the signals that guide the plane s landing so that it comes down a half-mile short of the runway and crashes. Several months later he causes another company plane to crash. This scenario is plausible, but is a bit less likely to pose a credible aviation threat. In this scenario, the type of aircraft being targeted would be required to have a radio altimeter (which reads feet above ground level) and would likely have some sort of ground-proximity warning system. Both of these devices would warn the pilots of an impending contact with terrain. In addition, most professional flight crews complete multiple cross-checks on final approach, and would notice a discrepancy between the published approach parameters and what the flight instruments were reading. It

4 is possible that a complacent flight crew could be caught off guard by such as scheme, but the scenario is less likely to be successful than the previous two scenarios Scenario Four: Data Mining In this scenario, a company is created that tracks corporate planes looking for planes from different companies that go to the same or nearby locations at about the same time. The idea is to get tips about which companies might be negotiating with other companies. This information might have great business value. This scenario is quite plausible and should be an area of concern. Unless the information is somehow protected, the granularity of the data provided into the air traffic control system by ADS-B will allow for data mining opportunities for all types of information gathering purposes. Individuals, news organizations, paparazzi and foreign intelligence agency will have easy access to data that is either unavailable or that is far more time consuming to aggregate from the current air traffic control system. 4.3 Information Gathering Scenario Due to National Security concerns, certain military and government flights need to be operated off the radar and in secrecy. The movement of tactical aircraft such as bombers and fighters, logistics movements of troops and supplies, and flights involving government officials should not be information disseminated to the general public. However, this information can easily be pieced together via data collected from ADS-B transmissions, creating an Operational Security risk to our military and elected representatives. In this scenario, a nation state utilizes the granular information provided by ADS-B transmissions to gather intelligence information on military aviation activities. An enemy nation state has been concerned over a possible bomber strike on one of their chemical weapons production facilities. They have placed intelligence operatives in the United States, and have been watching for signs of bomber aircraft movement. The enemy operatives know that tactical aircraft such as bombers will be flying with ADS-B Out disabled, but they are aware that the air refueling aircraft used to refuel those bombers inflight fly with ADS-B Out enabled. The intelligence operatives have been monitoring flight activity at two KC-135 tanker bases in New England. The operatives are monitoring the ground control and tower frequencies at these bases, and are logging call signs, takeoff and land times, and gathering flight information on departing and arriving tanker aircraft. The operatives note that two tanker aircraft depart simultaneously, one from each base. Utilizing laptop computers and easily developed software, the agents begin gathering data from the 1090 MHz ADS- B Out transmissions. From this data, they are able to tell what airspeed each aircraft was flying at when it left the ground. Based on publicly available data on the KC- 135 and the current weather conditions, they are able to determine the approximate takeoff weight of each aircraft, and consequently, how much fuel it is carrying. Utilizing data provided to the air traffic control system by ADS-B, the agents are able to monitor the flight paths of each aircraft and observe that the two aircraft rendezvous inflight and continue north as a formation. The operatives watch the aircraft as they proceed up over northern Canada, and turn toward the east. The aircraft continue on this eastern track for several minutes, and then turn back toward the south. The agents follow the flight of each aircraft as they split up and return to their respective bases. When the aircraft arrive at their bases, the agents are able to obtain the landing speed of each aircraft from the ADS- B Out information. Using the information they have gathered, they are able to calculate approximately how much fuel was offloaded during the flight. They are also able to discern, based on readily available information regarding the observed airspeed of the tankers on their easterly heading over northern Canada, that the tankers were refueling a flight of B-2 Stealth Bombers. After analyzing this information, they pass on the likely impending bomber strike, and give their government several hours lead time to relocate sensitive equipment at the chemical weapons facility. This scenario is very similar to Scenario Four in the previous section and should be an area of concern. The ability of individuals and state-sponsored groups to gather information directly from the ADS-B transmission and indirectly from the information provided by ADS-B into the air traffic control system poses a substantial Operation Security risk to our military and elected officials traveling aboard government aircraft. The obvious solution is for sensitive flights such as these to operate with ADS-B Out disabled. This, however, poses significant challenges for tracking these aircraft in the FAA s non-radar NextGen air traffic control system. 5. Hackers + Airplanes = No Good Can Come of This The title of this section comes from a talk delivered at DefCon 20 by Brad "RenderMan" Haines [7]. In case anyone thinks that hackers have not noticed the vulnerabilities we have been discussing, this is a false hope. DefCon features talks on hacking a wide variety of systems and it is always worth looking at the materials available at [8]. In addition, many of the talks at DefCon feature videos available on YouTube. We briefly mention and describe two free, open-source projects that have the potential to be widely used by the hacking community to build systems that can interact with NextGen. The first project is the GNU Radio project. The GNU Radio project provides both a C++ API and a Python

5 API. Nick Foster has provided a demonstration project showing how GNU Radio can be used to track aircraft. His code can be downloaded from github [9]. The following quotation from the GNU Radio website [10] provides some information about this project. GNU Radio is a free & open-source software development toolkit that provides signal processing blocks to implement software radios. It can be used with readily-available low-cost external RF hardware to create software-defined radios, or without hardware in a simulation-like environment. It is widely used in hobbyist, academic and commercial environments to support both wireless communications research and real-world radio systems. The second project is a sophisticated, open-source flight simulator designed for research, pilot training, and entertainment purposes called FlightGear [11]. The software has realistic flight dynamics for a variety of military, commercial and general aviation aircraft. The project has a worldwide airport and scenery database, and provides an excellent platform for demonstrating the target injection vulnerabilities in the ADS-B system. The following quotation comes from [12] and addresses several of the scenarios discussed in this paper and elsewhere. The FAA said that the ADS-B system is secure and that fake ADS-B targets will be filtered from controllers displays. An FAA ADS-B security action plan identified and mitigated risks and monitors the progress of corrective action, an FAA spokeswoman told AIN. A spokeswoman for key ADS-B contractor ITT Exelis explained, The system has received the FAA information security certification and accreditation. The accreditation recognizes that the system has substantial information security features built-in, including features to protect against spoofing attacks. [This] is provided through multiple means of independent validation that a target is where it is reported to be. The FAA has not provided any details on the testing or accreditation process, and is basically saying trust us! 6. GPS Vulnerabilities The NextGen system will rely heavily on GPS. Because of this it is worthwhile to examine the vulnerabilities of systems based on GPS. Of special interest is a briefing given by James V. Carroll in 2001 [13]. Unfortunately, the vulnerabilities discussed in this presentation continue to be vulnerabilities. Because of space constraints we will just mention some of the highlights from Carroll s presentation. Carroll makes three very important observations in [13]: GPS users are vulnerable to signal loss or degradation. Awareness and planning can mitigate the worst vulnerabilities. The vulnerabilities will not be fully eliminated. GPS is vulnerable because it uses a very weak signal on a single civilian frequency. In addition, because of military applications, there is a GPS disruption industry. It is relatively easy to build or buy a GPS disruption device. GPS disruption can take a variety of forms including jamming and spoofing. Jamming prevents a GPS receiver from receiving a valid GPS signal and can lead to unwanted behavior. Spoofing can mislead pilots and control systems and lead to disaster. Carroll stresses the need for back ups to the standard GPS systems. We do not have space to examine the subject of backups for the GPS system, but one system to consider is the Nationwide Differential GPS (NDGPS) Service operated by the Coast Guard [14]. 7. Normal Accidents The sociologist Charles Perrow has written a book called Normal Accidents [15]. The book introduces the concept of a system accident which he also calls a normal accident. In a nutshell, the idea is the following. Usually, when an accident happens we want to blame some individual or group of individuals. Yet, Perrow argues that in many cases the true culprit is the system that has been created. In particular, the system is set up so that serious accidents are inevitable, hence the term normal accident, and it is just a matter of dumb luck who the individual is who is left holding the bag when the accident occurs. A famous example of this is the 1999 loss of the Mars Climate Orbiter satellite because of a communication error. A review of the incident [16] showed that the error resulted because there were two software development teams. One of the teams used the metric system and the other used the imperial system of measurements. It is easy to say that the error might be the fault of some individual, but it is clear to most people that it is just a matter of time before such an error would have occurred. According to Perrow, system accidents happen because various aspects of the system make them more likely to occur. One factor that contributes to system accidents is the complexity of the system. Perrow s book [15] is full of fascinating accounts of accidents that happened because of unexpected interactions of factors. Of course, sometimes the accidents happen because of expected interactions as in the Mars Climate Orbiter disaster mentioned earlier. Of special relevance to us are the accidents described in Chapter 6, Marine Accidents, of [15] which are called noncollision-course collisions. These are collisions in which two ships were originally on courses that would have caused them to pass by each other safely, but because of actions on the part of one or both crews, the ships ended up colliding.

6 Some of these collisions occurred on the open ocean and where it would have been difficult for the ships to collide even if they had been trying to ram each other. This type of accident is relevant to our study because in maritime systems there is generally no central authority controlling the ships movements and each ship has a radar device that shows the other ship s location, and yet they still collide. It is imperative that aircraft not be involved in noncollisioncourse collisions. A recent example [17] illustrates how complexity can cause disruptions. Fortunately, no one was hurt in this series of incidents. In particular, officials at Newark airport noticed that the GPS based system called Smartpath would experience interference on a regular basis. They traced it to a driver for an engineering company who often drove by Newark Liberty Airport, but who was using an illegal $100 GPS jammer to confuse the tracking device placed in the company vehicle by the company. The low cost and easy availability of GPS jammers suggests that the FAA needs to be prepared for GPS malfunctions in the future. In particular, as advised by Carroll [13] the FAA has to have a reliable and robust backup system available in case GPS signals get jammed or spoofed. 8. Alternatives There is a pressing need to develop alternatives and solutions to address the ADS-B frequency saturation capacity and signal security shortcomings. Workable solutions need to employ existing technologies in order to minimize the cost impact as well as decrease the implementation timeline. These solutions need to include methods of encrypting the ADS-B signal within established secure channels and modifying the ADS-B protocol to allow for the signal to be transmitted via HF band and satellite communication channels. Possible solutions for increasing the security of ADS- B for military and government aircraft involve feeding the ADS-B data streams into an encrypted channel such as Mode 5 Level 2. Mode 5 is a new IFF (Identification Friend or Foe) technology designed to replace the aging and easily compromised Mode 4 IFF system. Mode 5 Level 2 allows for an encrypted communication that sends a unique aircraft PIN along with an aircraft position report. Sending the ADS-B data stream through the Mode 5 Level 2 encryption channel would allow for secure control of military and sensitive government aircraft flights in non-radar environments [1, pp ]. A solution for the 1090 MHz frequency saturation problem is to develop alternative transmission channels for the ADS-B signal, utilizing communications channels other than UHF. Possible solutions utilizing present technology include HF and satellite communications channels. HF frequencies are notoriously prone to atmospheric disturbances and interferences, but recent work in the area of Wide-Band HF may hold some promise for increasing the reliability and throughput of HF transmissions. The Wide-Band HF protocol uses a spectral analysis and band compression to create a long-distance communications channel that could be employed to pass flight data to ground stations. Another solution for passing ADS-B position information over long distances is via satellite communications. Both of these communication channels could utilize existing technologies to achieve reliable and precise position information over very long distance for aircraft operating in non-radar environments. 9. Drones A recent near mid-air collision incident [18] involving a US Airways regional jet and a suspected drone has set off a new round of discussion regarding drones operating in the same airspace as conventional aircraft. This discussion is pertinent to the FAA s NextGen and ADS-B. In order for unmanned aircraft to safely fly in close proximity to conventional air traffic, there needs to be a method of precisely monitoring these drones at all times. In the case of the US Airways flight, it is unclear as to whether the drone was a model aircraft being flown too close to the Tallahassee Regional Airport, or if it was indeed a military or commercial drone. The FAA s definition of what qualifies as a model aircraft and what is a drone (a UAV) is somewhat ambiguous further complicating the situation. The FAA has strict limits on operating any model, UAV or aircraft within 5 nautical miles of an airport. In the case of the Tallahassee Regional Airport, whoever was flying the aircraft was in clear violation of the Federal Aviation Regulations, and could be facing some rather steep fines if caught. Obviously the Department of Defense has a significant interest in UAVs for both reconnaissance and tactical employment. Over the past 5 years, interest in UAVs for commercial use has also grown significantly. The availability of cheap and reliable components for propulsion and control has made UAVs a very attractive technology to explore for a host of surveillance and logistics applications. All of this interest leads to the question of how to integrate these devices into the existing and already crowded air traffic control system. Aside from the airspace integration concerns, this exploding interest in UAVs creates huge potential security risks. For example, the loss of a U.S. stealth drone in 2011 appears to be a case of hacking [19]. The pilots of the UAV lost control of the drone, and it appears that the Iranians were able to steal a multi-million dollar piece of hardware along with the underlying technology. The thought of a sky full of UAVs that could be potentially hacked is a very sobering one. The damage that someone could inflict with a several thousand pound UAV capable of flying at several hundred miles per hour is a pretty scary scenario to contemplate.

7 Currently most UAVs are restricted to operating along specially designated corridors and within special use airspace. A major concern for a pilot is when a UAV or drone goes into homing pigeon mode. The majority of UAVs are preprogrammed to return home if they lose contact with their controlling ground station. In most cases, the controlling agency notifies ATC of the problem, the drone flies along a pre-determined flight corridor and ATC vectors aircraft away from this flight path. The problem occurs when, whether due to a latency in communications or some other failure in the system, the controllers are unaware that they are no longer controlling the UAV. The potential exists for the UAV to start its return home without anyone being aware it is doing so. In a radar environment, ATC will eventually notice the UAV off its planned routing, but until then it is a potentially hazardous situation. This potential hazard will be compounded as we move toward integrating UAVs into the broader ATC system. It gets even worse when one considers the impact of the FAAs NextGen in creating a non-radar environment over the contiguous 48 states. We hope that drones delivering packages for Amazon remain more science fiction than science fact. Needless to say, it is clear that hackers are keenly interested in creating their own drones and they are not the most safety conscious when piloting them. [20] describes an illegal flight carried out by hackers who wanted to build their own UAV. Fortunately, no one was injured when the drone crashed. 10. Conclusions and Recommendations It is clear to us that much more thought needs to go into the security of the FAA NextGen system and that it should not be rushed into production. Based on the analysis in this paper we recommend the following. 1) A thorough risk assessment needs to be carried out to make sure all scenarios have been considered. 2) There should be no rush to dismantle the ground based radar systems, since these might be very useful in a wide variety of situations. 3) Much thought should be invested in making sure that there are all sorts of alternatives and back-up systems available. Nothing must compromise the safety of the system. 4) All communication should be encrypted. Sending critical information as cleartext should be avoided at all costs. 5) The issue of frequency saturation of the 1090 MHz band in congested airspace needs to be addressed. Some alternatives worth considering are opening up additional frequencies in the UHF band, utilize VF and HF frequencies, use satellites and also spread spectrum techniques. 6) The FAA wants to tie a unique identifier to a transponder for its lifetime and broadcast that identifier so that everyone can spot it. This opens up the possibility of all sorts of monitoring and information gathering. We believe that the system should generate a unique ID for each transponder for the duration of each flight. 7) It is essential that jammers be made much more difficult to obtain even though they are easy to build. In any case, whatever system the FAA adopts must be able to cope effectively with missing, jammed, degraded or spoofed GPS signals. References [1] Donald L. McCallie, Exploring Potential ADS-B Vulnerabilities in the FAA s Nextgen Air Transportation System, Air Force Institute of Technology, Graduate Research Project, June 2011, [2] Instrument Procedures Handbook, FAA-H A, [3] Instrument Procedures Handbook, FAA-H , 2014, instrument_procedures_handbook/media/faa-h pdf. [4] FAA Faces Significant Risks in Implementing the Automatic Dependent Surveillance - Broadcast Program and Realizing Benefits, FAA Report AV , October 12, 2010, [5] Federal Aviation Administration, FAA s NextGen Implementation Plan, Washington, DC. /media/nextgen_implementation_plan_2013.pdf [6] Darryl H. Phillips, Will ADS-B Increase Safety and Security for Aviation?, 2000, [7] Brad RenderMan Haines, Hackers + Airplanes: No Good Can Come of This, Presentation at DefCon 20, [8] Defcon Conference, [9] Nick Foster, Tracking Aircraft with GNU Radio, 9/14/2011, Code may be downloaded from [10] GNURadio Project, [11] Flightgear Flight Simulator, [12] Matt Thurber, Hackers, FAA Disagree Over ADS-B Vulnerability, AINonline, August 21, 2012, [13] James V. Carroll, Vulnerability Assessment of the Transportation Infrastructure Relying on GPS, DOT/OST Outreach Meeting, October 5, 2001, [14] NDGPS General Information, United States Coast Guard, [15] Charles Perrow, Normal Accidents, Princeton University Press, Princeton, NJ, [16] CCN, NASA s metric confusion caused Mars orbiter loss, September 30, 1999, [17] CBS News, N.J. Man In A Jam, After Illegal GPS Device Interferes With Newark Liberty Operations, [18] CNN, FAA official: Drone, jetliner nearly collided over Florida, May 11, 2014, [19] John Walcott, Iran Shows Off Downed Spy Drone on TV as U.S. Assesses Loss of Technology, Bloomberg News, December 9, 2011, [20] Michael Weigand, Brad Haines, Mike Kershaw, Build your own UAV 2.0, DEFCON 18, Las Vegas, NV, July 30-August 1, 2010,