Friendly Jammers: The U. S. Military's Threat to Commercial Aviation

 

The Global Positioning System (GPS) that allows a few dollars' worth of electronics to determine your position within a few feet almost anywhere in the world has proved to be a great boon to aviation, which previously relied on an expensive and not that reliable network of ground-based technology for electronic navigation.  Newer aircraft use GPS as an essential part of their autopilot system, for example.  A report in the February 2021 issue of IEEE Spectrum shows that this happy situation is frequently being disrupted by the U. S. military in test exercises that use GPS jammers and spoofers, especially in the western United States.  Despite a formal requirement to warn pilots that such tests may be occurring, these tests have caused numerous problems to pilotes and even near-accidents over the last decade or so. 

 

In fairness to the military, GPS is their baby.  Deployed initially with a secret feature that degraded its accuracy for non-military users, it was designed primarily for combat uses, and commercial uses began as a kind of afterthought.  In 2000, this "selective availability" option ended, and now anybody, military or commercial, can get the highest accuracy possible out of the system.

 

Understandably, pilots and airframe makers have begun to rely on GPS almost exclusively for routine navigation.  The bad old days of shooting the stars with a sextant ended when various radiolocation technologies such as VOR (VHF omnidirectional range) were deployed after World War II, but in the last few years the Federal Aviation Administration (FAA) has been decommissioning those stations in preference to GPS.  And GPS works fine, except when it doesn't.

 

Because GPS is now an essential part of military operations, the U. S. military is now coming up with ways to deprive the enemy of it.  By the time satellite-transmitted GPS signals reach the ground, they are weak enough that suitable ground-based transmitters can either simply overwhelm them with interference (jamming) or worse, imitate them to deceive any GPS receivers in the vicinity (spoofing).  By law, any such military tests have to be announced to the aviation community through Notices to Airmen (NOTAM).  But these notices tend to be very broad, blanketing multiple states for days at a time, and most notices do not result in pilots experiencing any interference.  The net effect is that when GPS jamming happens, it tends to take pilots by surprise, and you don't want to startle a pilot when he's doing his job, or even when she's doing her job.

 

One of the worst such incidents happened in May of 2020 as a commercial airliner came in for an approach to El Paso International Airport in West Texas.  It was early morning, still dark, and that airport is surrounded by high mountains that pose threats to airplanes that are not where they're supposed to be.  Suddenly the pilot lost his GPS position, and rather than attempt to land blind, he declared a missed approach, went around, and landed on a different runway guided only by air-traffic control.  In a report he wrote about the incident, he remarked dryly that the runway he used "has a high CFIT threat due to the climbing terrain in the local area."  CFIT stands for Controlled Flight Into Terrain.

 

Investigation by Spectrum reporter Mark Harris revealed that such incidents are much more common than previously believed.  In one six-month period in 2017, for example, 96 GPS disruptions occurred in commercial aviation.  This led the FAA to ask the nonprofit Radio Technical Commission for Aeronautics (RTCA) to investigate the problem.

 

The RTCA's report recommends several things, but it's not clear that many of them have been implemented.  Better reporting of GPS failures due to military interference was one of them, and now the FAA wants pilots to report any such incident, not just if it required the intervention of air traffic control.  But many other recommendations, such as the military making more specific NOTAMs that describe exactly when and where the interference will happen, have apparently not been acted upon.

 

According to Harris, the situation is only going to get worse, as GPS manipulation becomes a more important feature of war games in military reservations, and as GPS becomes increasingly relied on as the main navigational technology used by airlines. 

 

This kind of situation is very familiar in engineering ethics, and can be characterized as the passed-out canary in the coal mine.  As you may know, in the days before technology was available to detect methane that could lead to an explosion, coal miners carried along canaries, whose respiratory systems are more sensitive than those of humans.  If the canary showed signs of distress, it meant there was enough gas to be dangerous, and the miners took steps to avoid igniting the gas, such as stepping outside of that part of the mine.

 

The near-misses and other distressing but so far harmless incidents that military GPS jamming and spoofing have caused are the kind of warnings that a responsive, on-the-ball organization will seize upon for appropriate preventative action.  Nobody wants people to die because an avoidable accident wasn't avoided. 

 

It's a matter of judgment as to how much effort should be expended to avoid it, but a good measure of that effort is to monitor the frequency of near-misses to see if remedial actions are making them less frequent.  If they are, the changes are doing their job.  But according to Harris, GPS failures are only increasing.  And as the aviation industry relies more exclusively on GPS for takeoffs and landings, it is just a matter of time before something really serious happens.

 

This situation is made worse by the distributed nature of the responsibilities involved:  the U. S. military, the FAA, airline operators, airline manufacturers, and pilots.  With so much opportunity for finger-pointing, it's no surprise that not much substantive has been done.  It would be a tragedy if effective steps were taken to fix this problem only after somebody gets killed.  But sometimes it takes a tragedy to get people to do something.

 

Sources:  Mark Harris's article "Lost in Airspace" appeared on pp. 22-27 of the February 2021 issue of IEEE Spectrum.  Portions of it can be viewed at https://read.nxtbook.com/ieee/spectrum/spectrum_na_february_2021/lost_in_airspace.html.  I also referred to Wikipedia articles on GPS and VOR.

Accused Twitter Hackers Arrested

A couple of weeks ago, I blogged about a Twitter hack that made numerous celebrities appear to be offering $2,000 to anyone foolish enough to send them $1,000 in Bitcoin first.  I quoted a lawyer who said that authorities were pretty good about tracing Bitcoin transactions, despite that currency's reputation for enabling anonymous transactions, and that chances were good for an early solution to the case.

Turns out he was apparently right.  On Friday, July 31, the state attorney's office in Tampa, Florida arrested Graham Ivan Clark, a 17-year-old, and will prosecute him as an adult, as Florida laws allow in such cases.  Authorities in California, where Twitter is based, announced that two others, Mason Sheppard of England and Nima Fazeli of Orlando, Florida, are being charged in the case as well.  Fazeli is 22 and Sheppard is 19.

There are now a few more details about how the hack was done.  Somehow the alleged criminals obtained phone numbers for several Twitter employees.  In a technique called "spear phishing," they then tricked someone into calling what probably sounded like a legitimate helpdesk, where the caller persuaded the employee to give them credentials that allowed them into Twitter's critical control systems via targeted spear-phishing attacks on other employees.

One can imagine this playing out rapidly in a movie:  the scene switches back and forth between a teenager's cluttered bedroom in Tampa to the cool, sophisticated environment of a Silicon Valley megacorporation where the kid hoodwinks staffer after staffer, and at last he types something on his laptop and yells, "We're in!"  But Mr. Clark may not have gotten his ideas from a movie.  Just being a teenager may have been enough.

Brain researchers have found that the teenage brain is an odd mixture of sophistication and poorly-controlled impulses.  In a Time article by Alexandra Sifferlin, we read that the brains of teenagers are about as big as they're going to get, but not nearly as interconnected as those of people in their late 20s and older.  In particular, the prefrontal cortex, where planning and forethought occur, is not yet well connected to the limbic system, which deals with emotions and goes through a growth spurt beginning by age 12.  So all the pieces of the adult brain are there, but they aren't connected as well as they will be in an adult. 

Add to this fact that certain kinds of mental activity turn out to be easy for clever teenagers and even children, while other kinds of mentally challenging work isn't.  For example, the world has known of many child prodigies in math (Blaise Pascal was writing proofs on the wall with a piece of coal by age 11) and music (Mozart).  But there haven't been any child-prodigy novelists or statesmen.  I'm not saying Clark is another Pascal, not by a long shot.  But programming and its illegal subset of criminal hacking are activities that smart young people can easily master on their own without undergoing a long apprenticeship.

So couple that native ability with the poor impulse control of a teen brain, and you get situations like the one Graham Clark is in.  Yes, he did a clever thing that got him a lot of publicity and some money.  But now he's facing criminal charges (a laundry list of 30 felonies) that could put him in jail for much of his natural lifespan.

In this case, anyway, crime didn't pay.  But how about Twitter, and how apparently easy it was for the three hacketeers to spoof and spear-phish their way into one of the most prominent Silicon Valley social media companies?

This kind of thing is an IT security specialist's nightmare.  Despite all the encryption, coding precautions, and other software and hardware security you can throw around, any organization of any size relies on interactions among people who trust each other.  And unless all the people work in one room and know each other's names and behaviors (an increasingly rare situation in these COVID-19 times), there is always a chance that a properly-informed hacker could impersonate someone in the organization to steal credentials or other critical data. 

It's hard to think of a way to prevent this kind of thing absolutely, but I bet Twitter is reviewing its IT security rules right now to prevent another such attack.  This is a lesson that engineers, and really anybody involved in dealing with confidential information, can benefit from.  For some of us, it might not be anything more important than a credit-card number, though having your credit card hacked is no picnic (it's happened to me several times). 

For organizations such as Twitter that have extremely valuable credentials to protect, it's hard to say what policies would prevent hacks like the one masterminded by Clark.  Whatever they might be, they would have to partake of a kind of rigidity that goes against the Silicon Valley grain.

For example:  I once heard of a restaurant whose management held so highly the safety and well-being of their customers, that if any of the people who laid out the silverware on the table was caught touching a fork anywhere above the handle so as to get their fingers on something that would later go into a customer's mouth, that person was fired on the spot.  Excessive?  Probably.  But it bespoke a kind of integrity and seriousness that may be in short supply these days.  Nevertheless, such an attitude might go far, if turned into data-protection protocols, toward preventing the kind of thing that happened to Twitter.

Twitter recovered, after some embarrassing publicity.  The alleged culprits were caught, and now people can follow the Kardashians or whoever without fear of getting spurious tweets from them.  So maybe the price of an occasional hack is worth the laid-back atmosphere that allowed a seventeen-year-old to make a fool out of a famous social-media company.  To prevent hacks like this in the future, organizations like Twitter may have to implement rules that are inconvenient or even harsh.  But with great privileges come great responsibilities, and that may be a lesson a lot of us have yet to learn.   

Sources:   The Associated Press article by Kelvin Chan on the arrest of Clark and company was carried by several news outlets, including https://www.boston.com/news/crime/2020/07/31/florida-teen-charged-in-massive-twitter-hack-bitcoin-theft.  I also referred to an an article at https://www.usnews.com/news/business/articles/2020-07-31/twitter-says-hackers-used-phone-to-fool-staff-gain-access.  The detail about Pascal's proof in coal dust is from Wikipedia's "List of child prodigies" and the Time article on teenage brains can be found at https://time.com/4929170/inside-teen-teenage-brain/.