The new air-traffic control system the Federal Aviation Administration is using could allow America’s enemies to track U.S. military aircraft under certain conditions—and the Pentagon is running out of time to fix the problem.
The Automatic Dependent Surveillance-Broadcast system uses satellite technology and equipment on board the planes to tell each other’s locations. It is part of a broader air-traffic-control overhaul that began in 2007, which partially replaces the FAA’s traditional system of tracking planes with radar on the ground.
But once it comes fully online in less than two years, ADS-B will track, and broadcast the location of, nearly every airplane in the sky over the United States—including military warplanes whose flights today are closely held secrets.
ADVERTISEMENT
Meanwhile Australia, Canada, Sweden, China, and other countries are also integrating ADS-B into their air-traffic-control networks. Anyone can buy the ADS-B gear from commercial vendors, including terrorists and criminals.
The Defense Department has known about the system’s security risks since at least 2008, but has yet to fully address them, according to the Government Accountability Office, a federal watchdog agency.
“Unless DoD and FAA focus on these risks and approve one or more solutions in a timely manner, they may not have time to plan and execute actions that may be needed before Jan. 1, 2020—when all aircraft are required to be equipped with ADS-B Out technology,” the GAO warned in a January 2018 report.
The GAO claimed it has already used ADS-B “to track various kinds of military aircraft.” The agency is especially worried about America’s most sophisticated warplanes such as its F-22 stealth fighters, which are designed to avoid detection.
“Broadcasting of detailed and unencrypted position data for fighter aircraft, in particular for a stealth aircraft such as the F-22, may present an operations security risk.”
For the Pentagon, ADS-B represents just one of several embarrassing and potentially damaging security lapses in the past decade. According to the U.S. Army, in 2007 insurgents in Iraq used location data embedded in photos American soldiers had posted online to lob mortars at a U.S. base, destroying four Army helicopters.
More recently, GPS-tracking company Strava has used satellite data to map the movements of subscribers to its fitness service. The results, published on a company website in late 2017, apparently outline secretive U.S. military sites in Yemen, Somalia, Iraq, and Syria.
The U.S. Air Force, for one, realizes it has a problem with the new air-traffic-control system. “It is very possible to track platforms transmitting unencrypted ADS-B data with non-complex [off-the-shelf] equipment,” Staff Sgt. Sarah Trachte, a spokesperson for the Air Force’s Air Combat Command, told The Daily Beast.
While warplanes flying combat missions overseas don’t use civilian air traffic control and therefore can’t be tracked via an inexpensive ADS-B In receiver (Garmin sells one for $5,000) military aircraft on training and test flights in the United States are, at present, generally subject to ATC rules and would broadcast their locations via their ADS-B Out transmitters.
More worryingly, military planes conducting domestic counterdrug and counterrorism missions, and fighter jets protecting high-value targets such as Air Force One, would also broadcast their locations. Besides being able to track specific U.S. military flights in real time, criminals, terrorists or spies could also use ADS-B data to “identify patterns-of-life” such as a particular squadron’s training routines or patrol routes, according to the GAO.
There are obvious solutions to the ADS-B problem, Matt Robinson, an ATC expert with Pennsylvania-based consulting firm Robson Forensic, told The Daily Beast. “Everything comes with an on/off switch,” he said.
The FAA already grants the military waivers from certain air-traffic-control rules, such as aircraft lighting, Robinson pointed out. As far as ADS-B is concerned, the trick for the Pentagon is hammering out an agreement with the FAA that excludes some planes from air-traffic-control requirements in certain places and times.
But negotiating with the FAA takes time. And since the ADS-B rollout began, the military and the FAA have focused on installing tens of thousands of ADS-B systems. They “have not focused on solving or mitigating security risks from ADS-B,” the GAO explained.
Two years isn’t a long time for massive bureaucracies to work out new rules between them. But the Air Force’s Trachte said that “necessary mitigation strategies” for ADS-B’s problems will be in place. She didn’t say whether the “mitigation strategies” will be ready by the January 2020 deadline.
“I would assume the military is in the process of obtaining waivers,” Robinson said.
