According to a new report by the U.S. Government Accountability Office (GAO), the U.S. airspace system is incredibly vulnerable to hacking and a state-sponsored hacking effort could paralyze air traffic over North America. Very scary stuff. And as a licensed pilot for 45 years, I can tell you that it’s both true and not true, that the system is horribly hackable but that very vulnerability might be what we need to stimulate real airspace innovation.
Ask any American pilot how they feel about the U.S. Federal Aviation Administration (FAA) and you’ll get variations on the same negative theme. It’s not that pilots love-hate the FAA: there’s no love about it. Pilots tend to hate-ignore the FAA, which is generally viewed as a vindictive regulatory agency caught-up in internal politics and bullshit (that’s a technical term for bureaucratic lethargy). Nobody loves the FAA.
The GAO report lays out any number of FAA vulnerabilities and makes 158 specific recommendations for improvements. We can’t know exactly what those recommendations are because they are only in the private version of the report delivered to Congress and presumably to the FAA. But it’s pretty easy to guess that the GAO recommends encrypting FAA communications and making the network more secure. The GAO probably recommends, too, some sort of watchdog program running in parallel to look for signs of intrusion and disruption before they cause real trouble.
The easiest way to mess with U.S. airspace is probably through a Distributed Denial of Service (DDOS) attack. This is a matter of using hundreds or thousands of zombie PCs to drown the FAA in so many communication requests that nobody can get through. It’s a common attack against websites but the FAA will argue that its network is separate from the Internet and immune to such interference. The problem with this response is two-fold. First, physical separation tends to argue that further techniques for intrusion detection are unnecessary. And second, physical network separation is an illusion if there are hundreds or thousands of PCs that are connected to the FAA and to the Internet, which there are.
Any outward-looking Internet services like the FAA website and the DUATS flight planning system are vulnerable as a matter of course. And any interconnection of networks only extends that vulnerability.
Now let’s kick it up a notch and presume that hackers gain access to airspace computers and try to mess with them. At the least this could disrupt the system creating traffic jams at major airports where the most vulnerable traffic is actually on the ground. If planes can’t get to the runway they can’t get in the air.
Once airborne there’s always the problem that aircraft could be sent bad data about traffic incursions or even given bad navigation information. Given the one-meter precision of Wide Area Augmentation System (WAAS) GPS, it’s possible that airplanes could be deliberately crashed into each other. It’s important to remember that in the case of airline traffic each of the big carriers has its own network that can be messed with in addition to that of the FAA. I’m not sure the GAO got as far as realizing this vulnerability.
Mitigating against all this is the simple fact that airplanes are flown by pilots and pilots aren’t stupid. I was flying in Silicon Valley back in 1981 when President Reagan fired thousands of FAA air traffic controllers, closing for months the towers at most smaller airports including Palo Alto where I was then based. Suddenly not having a control tower actually improved my life as a pilot back then. Everything ran smoother and there was no increase in the number of accidents. This is not to argue for firing controllers today but just to point out that pilots were (and are) generally up to the job of not crashing into each other.
The U.S. system of positive control airspace came into existence after two airliners collided 21,000 feet over the Grand Canyon back in 1956 killing all 128 people on both planes. The planes (one IFR one VFR) were in touch with Air Traffic Control only through messages passed along via their company (airline) radios. It was the greatest loss of life to that date in an air crash and led directly to the CAA becoming the FAA and spending millions on radio and radar coverage of the continental U.S. Since the 1960s, then, flight above 18,000 feet has been under the positive direction of a human on the ground looking at a radar screen.
That is unlikely to change. New data services are being added but centralized control is still the order and diverting from that strategy would take a decade or more just to plan, much less implement. But that doesn’t mean there are things that could be done to independently improve both the safety and efficiency of airspace.
If the FCC would face reality and authorize use of airborne cellular data, building a parallel air traffic system would be trivial. At the very least every airplane already has a GPS-equipped smart phone on board in the pilot’s pocket. Linking all those together in the cloud to get an airspace picture that could be compared to the one at the FAA would very quickly show when trouble was afoot as the two systems disagreed.
Yeah, we have an app for that.
“Pilots tend to hate-ignore the FAA, which is generally viewed as a vindictive regulatory agency caught-up in internal politics and bullshit (that’s a technical term for bureaucratic lethargy). Nobody loves the FAA.”
Yet, many are cheering in the streets that the FCC will soon have regulatory power over the Internet. Clowns to the left of me, jokers to the right.
That’s a logical fallacy and a red herring argument. With your logic, the FDA and EPA should not regulate so much because industries would “regulate themselves”, right?
You do realize that FAA is not the same thing as the FCC? Your argument makes no sense. Besides, I’d rather have the FCC regulate the internet than those greedy bastards at ATT, VZW, TimeWarner, etc.
If you like ObamaCare you will love ObamaNet.
Explain to me again how the private sector is superior after I get out of 8 hours of meetings.
That’s easy. The public sector can’t run out of money. If they do a poor job, they’ll tax us more to “fix” the situation.
I think it’s pretty safe to say that Apple is never going to run out of money either. 😉
Aren’t they the same thing?
I like to think of it as regulatory power over Comcast…and yes I am cheering.
Amen to that.
Comcast, Time Warner, Verizon, and AT&T brought it on themselves because they couldn’t keep themselves from enforcing their localized monopolies (and providing terrible overpriced service) by any means necessary.
you are misunderstanding the how of politics. the FCC will be regulating the monopolist ISPS exactly in the manner that the SEC regulates stocks & bonds. whenever ATTWarnerCast wants to raise rates or ease regulation they lobby the FCC for twice what they want and then settle for half. They WANTED the FCC. They OWN the FCC. And now they own the internet.
You can own the internet too. Just string a cable to every home in the country.
Unmentioned is the role of drones which are now capable of being flown into planes landing or taking off. I don’t see malicious hackers attacking the network to engineer an accident so much as using a drone for the same purpose.
I don’t buy this. Drones as they exist today are unlikely to be very useful for the sort of terrorism we are discussing. There are two issues — size and speed. Drones are small and slow. Small means they can’t carry much in the way of explosives or a big enough fuel load to do significant damage to property. Remember it was important to the 9/11 hijackers to grab the planes right after takeoff when they’d hold maximal fuel. Even the Department of Homeland Security, which sees bogeymen everywhere, says that small planes just don’t carry enough energy to really matter. And drones are even smaller. Then there’s the issue of speed. Here we are talking about the core issue of this column, which is messing with primarily airline traffic. When TV or radio news or a newspaper writes about a small airplane “hitting” an airliner, well that simply doesn’t happen. The airliner always hits the little plane. The differences in closing rate are such that the airliner can evade the small plane but the small plane can’t evade the airliner. Look at the El Cerrito collision for an example of this. So if you are a terrorist and your goal is to use a drone to bring down an airliner it simply isn’t going to work. And for terrorism of ground targets, drones are useful only for assassinations, which is how Predator drones — bigger than anything terrorists could buy — are used in Afghanistan.
It’s not the size of the planes, but the speeds. I would think the small plane would be the faster one. That was the case with the Chinese plan that went down after hitting the AWACS, and the crew ended up in Hanain.
Yeah, but FF 10 years where the average 5 year old has his own drone and the average terrorist has access to nuclear material. That could be a lethal combo…not 5 year olds and terrorists. 😉
Drone and nuclear material is not a lethal combination, except to the terrorist. It is like saying ‘suitcase nuke’. Good in theory, terrible in reality. To avoid killing the carrier, it wold have to weigh several tons.
You need to consider takeoff and landing speeds. I think a plane already airborne vs a jet taking off, it would be the small plane hitting the big one.
TWA800?
The cruise speed of a Cessna is 140 MPH. The takeoff speed of a 747 is over 178 MPH, The most probable cause of the TWA800 incident was a fuel tank explosion. While the investigation could not determine the exact cause it was able to rule out it being shot down, terrorism, etc.
.
I can think of only one way a non-military drone could possibly cause damage to an airliner. It would be very hard to do and the chances of it causing enough damage is very low. I won’t say how it could be done. I don’t want to give anyone ideas. Trust me, this would be a 1 in a million shot.
.
Before we assume a non-military drone can be used as a weapon or tool for terrorism, you need to look at the maximum weight (payload) it can carry. It isn’t much. Nuclear material? Dream on. It wouldn’t be able to lift enough to cause any harm. If it carried some highly radioactive stuff without (heavy) shielding the electronics would be fried in a few minutes.
I agree with you regarding nuclear drone, and said as much above.
I will respect your wishes and not repeat how a drone could take down a plane, though it is so bvious even Mary Poppins could do it.
The fuel tank explosion with zoom climb scenario is laughed at by aviation professionals that see the video produced by NTSB.
https://www.cashill.com/twa800/new_twa_800_video.htm
Re: “I won’t say how it could be done.” That reminds me of “security by obscurity”, and the new Google policy of publicly disclosing security flaws, that are not fixed within 90 days of private disclosure.
We’ve had an incident of terrorism with a small plane and an IRS office:
https://www.cbsnews.com/news/man-angry-at-irs-crashes-plane-into-office/
Probably too old an article for this, but what the heck. Interesting WashingtonPost.com article on drones & aircraft near misses including at airport approaches:
https://www.washingtonpost.com/world/national-security/faa-records-detail-hundreds-of-close-calls-between-airplanes-and-drones/2015/08/20/5ef812ae-4737-11e5-846d-02792f854297_story.html
Drones are a real problem awaiting a terrorist exploit.
Fly a drone into the jet engine – and now you have a big problem. No explosives needed.
If there are so many hackers that want to cause trouble for the US, the logical question is why? What have “we” done to incite their ire? Whoops, maybe “we” (the US government and their cohorts, not the ordinary US citizens) have stuck our big noses into way to many overseas affairs that were none of our business and as a result have killed too many innocent people. Maybe the rich and powerful people who want a US empire that controls everybody (and thereby causes massive trouble around the world) should be restrained from their evil deeds. Just some idle comments from little old me.
So all the hackers must be thinking like you?
While I do wish the US would be less keen on international interventionism, the fact that destructive hackers do not require nationalistic motivation at all.
Historically we know that hacks have been inspired by sheer maliciousness, the desire for notoriety, curiosity, financial gain, or even simple boredom.
Re: “What have ‘we’ done to incite their ire?” Perhaps simply enjoying a higher standard of living. Envy is one of the seven deadly sins.
Yes, some of the preceding remarks have a bit of truth in them. But the main truth is that the American Empire has done a lot to incur the ire of foreigners.
.
Imagine that you are a citizen of another country, minding your own business, and the armed forces of the U.S. swoop in and start murdering your fellow countrymen. Would you be a little ticked off? Would you want to get revenge?
.
Imagine that another country has become nearly the economic equal of the American Empire. Would the leaders of that country want to cripple the U.S. economy so they could take control of the surrounding region?
.
Imagine that certain areas in the world are controlled by the beliefs of a religion that despises other religions. Then suppose that some foreign country with a despised religion forcibly occupies some of those areas. Would some of the people in those areas want to harm the government and institutions of that occupying country?
.
Imagine that the people in a country choose a certain group of leaders. But then a foreign country forcibly removes that group and installs their own choice of leaders. Would that irritate the local people?
.
I could go on, but I think I have made my point. When you throw your weight around in the world and harm other people, you can incur a lot of ire, or a desire to replace your position in the world.
Thanks for bringing up those issues. While it may seem to the citizens of those countries, that the US is meddling where it doesn’t belong, the fact is the US is taking defensive moves due to the actions of the leaders of those countries, or a minority of terrorist factions within those countries. The fact that the good citizens of those countries who “mind there own business” do not, or cannot, control their own leaders or their own criminals, is no excuse for the US to engage in isolationism or fail to defend itself.
You’re too easy on me, Ronc.
Amazed nobody yet pointed out that cell networks do not reach the cruising altitude of airplanes. C’mon Bob as a pilot you should know this. When does cell coverage drop out? I’d guess a max of about 10k feet (2 miles)?
Not true. For one thing, how did those 9/11 passengers use their mobile phones to call home before they died? They were flying higher than you suggest. For another, I have personally, ‘er tested mobile service into the high teens. Yes, there’s beam shaping in the cell antennas used to keep the signal horizontal increasing effective radiated power (as a teenager I was chief engineer of a commercial radio station in rural Ohio) but the angle subtended by the airplane works just fine with the next cell over or the one after that, since line-of-sight is clear.
I can’t remember the exact numbers but I seem to recall that none of the 9/11 aircraft was above 10000′ for long, if ever. Certainly they weren’t above 10000′ when the passengers were using their cell phones. If you have a cell phone that will work over 10000′ AGL, it’l be churning through it’s battery at high speed trying to put out enough signal to keep the connection alive.
Almost all airborne wifi is in fact serviced by cellular type connections when over the U.S. mainland. Only when over the ocean or in a continental deadzone does it use satellite. The gear carried by the plane is of course far better than your average cell phone.
It is possible Ron Brown’s plane crashed because someone messed with the ground radar, causing the plane to go into a mountain. The person in charge of the equipment was found dead from a ‘suicide’ before he could be interviewed. One story I read suggested the Pakistanis were involved
Planes.. and cars too… I wonder how this type of thing will play out when hackers start messing around with cars hooked into the internet. Michael Hasting’s death could be the first case of remote car hacking causing death… how are we going to know when onstar etc. is hacked by anti-west Chinese and Russian hackers who just want to see what they can do?
Interesting note… just saw an ad for CSI: Cyber !
I assume they are going to highlight issues ( or more likely sensationalize issues ) like the one we are discussing.
For those of you not watching much TV. So far there are the original CSI: Crime Scene Investigation ( Las Vegas), CSI:Miami, CSI:NY and now CSI:Cyber which started last Wednesday on March 4, 2015.
For what it’s worth, the few times I’ve seen CSI-anything it’s been by accident. I’ll rely on the web to tell me how this new show turns out. I’m only interested that the issues are mainstream enough to have Cyber made ahead of, say CSI:Seattle. :p
EP1 = poop
Good poop or bad poop?
(I kid, I kid…)
I wonder how much ADS-B will be the other network that you are talking about. I know the airlines (and everyone else) still don’t want to spend money on it. Is it the solution that you’re discussing?
When Bob mentioned an “other” network he said “each of the big carriers has its own network that can be messed with”. That sounds like a problem, not a “solution”.
Build a parallel air traffic system? If a man with two watches never knows the true time, then does a pilot with two air traffic systems truly know where he is? Or more importantly, where the other planes are?
That’s why, when planning my TV viewing (recording), I use 3 websites.
Many years ago I remember being in Charlotte after a plane crash. The local press was outraged by it. The local pilots were furious. The FAA flew an airliner into a tornado producing storm. The TV stations had been tracking the storm and when the plane crashed it was obvious what had happened. The TV stations had doppler radars, air traffic did not. The new air traffic doppler radar system had been sitting in a Charlotte warehouse for 2 years waiting for the FAA to install it.
.
For years before 9-11 airline pilots had been petitioning the FAA to secure the cockpit doors. This was a known security problem with an easy fix. It was common for unruly passengers to barge into the cockpit during a flight. The FAA ignored the petitions for almost a decade. If they hadn’t, there may not have been a 9-11.
.
The FAA only acts when there has been a serious incident. I doubt they even comprehend the new cyber security threat. They certainly won’t listen to ideas for improvements. I just hope the news stories will embarrass them enough to take the necessary action. Unfortunately they will probably need a good scare before they will do anything. In this industry a good scare usually involves a large number of fatalities.
Just spitballing, but was there any reason the airlines had to wait for an FAA mandate to install secure cockpit doors? And is it possible they didn’t feel like spending the money and were lobbying against such a mandate?
https://www.motherjones.com/mojo/2010/09/one-911-familys-brave-effort-expose-airline-culpability
http://tinyurl.com/pd7pujv
That is a very good question Russ.
.
For many years the airline industry was a lot like a herd of lemmings. No one company would do something different from the herd. For years they collectively mismanaged their business and many of them failed. It took a few mavericks like Southwest to shake up the status quo and wake up the industry. One could speculate no one airline would install better doors if the others didn’t too.
.
When I first heard the story I did a little digging and reports on the airline pilots union making this request to the FAA.
.
Could a USA airline make such a change without the FAA’s approval. I really don’t know. I’d like to believe the airlines would be able to make such decisions on their own. But we have to remember we are talking about the FAA, one of the most brain damaged agencies in Washington DC.
Re: ” airline pilots had been petitioning the FAA to secure the cockpit doors. ” There may have been other factors to consider. Like a pilot with a heart attack or a rogue crew in the cockpit. In an emergency a flight attendant or even a passenger could brake in to the cockpit to take over. If I were a passenger on a plane with John Travolta, I’d feel safer knowing he could get in to the cockpit in an emergency. Prior to 9-11, there was no fear of sabotage from passengers since that would be suicide. Sort of like avoiding driving a car since another car could deliberately crash into you. You have to consider the likely scenarios over less the likely ones.
I thought the FAA had a next generation Data Communications Integrated Services contract in process that should start to be deployed pretty soon. Is it not secure?
I’m looking forward to the bump in Boeing, Rockwell-Collins and Honeywell stock prices. Since McCain can’t get any traction on invading Syria, they’ve got to do somehting to move the needle.
CYBER!!! OMG!!! They’re hacking my airplane! My Apple Watch won’t check me in!
Don’t forget Greyhound.
Has the Forbes gig ended? Did IBM put pressure?
I hope so. That site is painful to navigate, and “impossible” to comment on, even after becoming a “follower”.
I wonder how hard it is to write the COBOL code to hack into those Sperry mainframes (if you could connect with them in the first place).
Do you watch Airplane Disasters on Smithsonian channel? Each episode covers a specific crash and the investigation process. I find it interesting and excellent!
This is actually a question, as I have no personal knowledge of FAA rules enforcement. With all of the recent interest in drones, there has been a lot of talk about FAA rules and regulations that apply to them. For example, professionals, like real estate agents, scrupulously follow the rules about not flying over private property without permission. Others have commented that the FAA has no enforcement arm, so their rules can be ignored, since there is no police force to arrest, convict, or fine someone for violating FAA rules. Is it possible that the FAA rules are only behavioral suggestions?
.
When I was having trouble posting due to a spam filter problem, I contacted Jennie at Weblamb, and also Bob, who emailed this response: “I don’t know about the posting problem but I can answer your question. FAA regulations are civil, so the worst they can do is take away your license, possibly forever. In cases that are also criminal, like stealing airplanes, they can call on the U.S. Marshals and even the FBI, so arrests are occasionally made. But there are no rules ANYWHERE prohibiting flights over private property. There are minimum altitudes for some operations but even those can be busted if you claim to be ascending or descending. Drones that fly under 400 feet are pretty much unregulated as are RC models. You can’t fly them over the White House, but that’s because it’s RESTRICTED AIRSPACE right down to ground level and nothing can fly there without prior permission, which is given only ever given to Marine 1 — the President’s helicopter. So if you want to fly a drone over someone’s house to take pictures, go for it.”
It looks like the rules I was thinking of have been “proposed” but not yet implemented. https://www.faa.gov/news/press_releases/news_story.cfm?newsId=18295 I find this proposal especially confusing: “A small UAS may not fly over people, except those directly involved with the flight.” In other words, it sounds like it doesn’t matter whether the property is public or private, you can’t fly over it if there are people there, after the proposed rules are implemented.
Whenever engineers get together we end up discussing on how to better light up something.
A terrorist attack on the FAA’s IT infrastructure would have only limited effect due to the fact that planes are flown by people and there is so much redundancy in and around them.
I recall my teacher of Avionics and Navigation, we were in a cockpit of an AirFrance’s 747 and he was showing us all the instrumentation. “When all the electronics goes down, we still have the RAM and this!” and he shows to the wet compass.
It is amazing on how little one trained pilot can safely fly a distressed plane.
A plane without communications, but with enough fuel is as safe as it gets.
Note that the guys on the ground can and will also do just fine without centralized comms and even without electricity. They have walkie talkies (professional ones), they have flares (chemical), flashlights, spare battery packs and various other signaling devices.
Planes and airports have stand-by network independent equipment.
Airports have redundant power generators (network independent) that depend only on how much diesel you have in the fuel tank. Not to mention that there an abundance of aviation fuel that can one light up in a convenient pattern – if all else fails.
You want to crash a drone into an airliner? Well… an aspirated drone will leave you still with an engine – worst case. Pilots train for aspirated birds so loosing an engine is not that big of a deal for an airliner. The chance of taking out more than one engine is so slim that they are simply not worth it.
As long as everybody pays attention, any hack will be spectacular indeed, but it would be nothing than a major hindrance for the passengers and a little to medium waste of money for the companies. Just because they will have to ferry people from the emergency landing airfield to a major hub and eventually pay for a hotel night here and there.
From a technical standpoint here are targets with a better yield and it would be unethical to discuss them in a public forum.