Surveillance and Silliness

Slow down, Twitter. There's more to the Elon Musk aircraft tracking story.

So now everyone on Twitter is an expert on aircraft tracking and whether it’s an intrusion into the privacy of one wealthy, outspoken social media entrepreneur. Let me offer some background and perspective.

My qualifications: I am an Advanced Ground Instructor certificated by the FAA to teach the ground portion of flight training for any rating level except instrument. Also, several times a year, I conduct Rusty Pilot seminars designed to help out-of-practice pilots adapt to the complicated and unforgiving regulatory airspace in the Washington DC region where I live and teach. ADS-B compliance is a big part of that training, and of this story.

For decades, aircraft in the United States flying within a 30 nautical mile ring centered on Class B airport¹ , within the lateral boundaries of a Class C airport², or higher than 10,000 feet above mean sea level and more than 2,500 feet above the ground, have been required to be equipped with a transponder. This is the transmitter that participates in secondary surveillance radar (SSR). When operating in such airspace the aircraft transmits a 4-digit octal signal (that is — a four digit number where each digit can take a value 0 - 7) that is received by a ground location. This information is relayed to Air Traffic Control in a way that permits them to see your position represented on a map.

The particular transponder code an aircraft transmits is assigned by ATC at the time a request to enter the airspace is announced. It does not have a permanent connection to the aircraft. If you are flying outside an airspace where a unique “squawk code” is required and you are not flying on an instrument flight plan, your transponder code is 1200. Many, many planes will be in the sky squawking 1200 simultaneously. This is unimportant, because preventing two aircraft from colliding does not require that you have a unique ID for every individual aircraft.

On January 1, 2020, the FAA required that all aircraft operating anywhere that transponders were previously required were now in addition mandated to use a technology called Automatic Dependent Surveillance - Broadcast or ADS-B. This is the technology that is causing all the current Twitter fuss re: Elon Musk and his unhappiness with having the real-time location of his private aircraft streamed online.

In contrast to traditional SSR, ADS-B has peer-to-peer capability. ATC still sees an ADS-B equipped aircraft via re-broadcast from a ground station, but in addition any aircraft equipped with ADS-B “in” gets direct information about aircraft in its vicinity transmitting ADS-B “out” signals. These positions can be displayed in near-real time on moving map displays that incorporate warnings about aircraft flying near to one’s own position. This is obviously an enhancement of in-air situational awareness and makes flying safer for those so equipped, flying in airspace where it is reasonable to expect everyone else in the air is also so equipped.

Another crucial difference about ADS-B compared to older transponders is that the standard mandated by FAA/ICAO requires that each ADS-B “out” be registered to a single aircraft and that aircraft’s unique ID be broadcast as part of the signal. Where before an aircraft would be visible only to ATC as “squawking 6423” an ADS-B “out” equipped aircraft transmits its tail number to everyone with ADS-B “in”.

Three other unique factors of the US aviation landscape combine with this technology to create the situation we have now:

• The FAA Aircraft Registry is open to anyone to search or download, and it is a trivial matter to associate an individual or a company with an aircraft registry.

• The FAA permits third-party applications to track movement of ADS-B equipped aircraft and display this information in real time. Two popular sites are FlightAware and ADS-B Exchange.

• Even if these sites did not exist, someone with a $200 budget, an Arduino kit, and a middling understanding of circuit boards could build a receiver capable of tracking ADS-B “out” signals in a weekend. Thousands of such tracking stations are already in operation.

Since the current focus is on the privacy implications of having ADS-B tracks be publicly viewable, I should probably stipulate that:

• During the thirty years of debate, endless NPRMs and associated periods of public comment while ADS-B was being designed and implemented — many, many pilots, air operators, and other interested parties tried to warn the FAA that their proposals carried significant privacy risks, and these concerns were never taken seriously, at least in public.

• This situation is almost unique to the US. The EU also requires ADS-B but there is no European version of FlightAware or ADS-B Exchange. Nothing about ADS-B as a tool of aviation safety requires that this data be available to the general public. The FAA could have fixed this prior to the 2020 mandate and did not. So here we are.

This is what the feed from FlightAware looks like, very late Friday/early Saturday in the Baltimore area.

By hovering over a plane icon, you can get the registered information about the aircraft. If you are interested in following a particular tail number or call sign you can put that into the search engine.

Just to be clear: you do not have to be a tech-bro plutocrat with a fleet of personal Cessna Citations or Embraer Phenoms to be concerned about the level of surveillance and intrusion that this technology enables. I am a private pilot who owns an airplane valued at about 1/4 the price of a new full size pickup truck and it absolutely upsets me that with 15 minutes Googling someone who wished me ill, or wanted to stalk me, could track me around the skies like this.

After copping their dismissive back-handed attitude towards privacy concerns during the onboarding of ADS-B, the FAA did finally admit that the private aviation industry had a legitimate concern and instituted the band-aid solution of allowing aircraft owners to opt out with two tools: Limiting Aircraft Data Displayed (LADD) and Privacy ICAO Address (PIA).

LADD is limited to data shared from the FAA to third parties (such as FlightAware). The problem is that the ADS-B technology has enabled data capture that is not controlled by the FAA.

This is a screenshot from ADS-B Exchange:

And I believe I will just let these folks speak for themselves on this one:

ADS-B Exchange differs from typical flight tracking sites in two primary ways.

First and foremost ADS-B Exchange does not participate in the filtering performed by most other flight tracking websites which do not share data on military or certain private aircraft. Because ADS-B Exchange does not use any FAA data there are no FAA BARR/LADD, military, or other “filters” preventing you from seeing the the data you collected. 

So for this application, enrolling in LADD buys you nothing. Because they obtain their data from crowd-sourced applications (which, remember, were enabled by the FAA refusing to require that these data be encrypted or protected from public capture) the FAA’s opt-out program has no jurisdiction here.

Now the fallback: the PIA program. This was the FAA’s answer to the problem they already created by mandating that aircraft broadcast their position, altitude, and ID in the clear. You can request a Privacy ICAO address! Just jump through the FAA hoops and you can change your broadcast aircraft ID every 30 days. No one could possibly track you then…could they?

Oh yes they could. And that is the crux of the dispute between Musk and an insolent tech-weenie named Jack Sweeney who has figured out how to leverage the information made available over the ADS-B Exchange network to identify which aircraft is Musk’s even after enrollment in PIA.

I’d like to be clear here: I don’t blame Sweeney for leveraging everything he can game out of the current information stream to do what he wants. I don’t blame Musk for going nuclear over his perceived inability to protect his family from violent targeting enabled by the fact that his aircraft can be tracked in real time even though he had jumped through every hoop provided by the FAA.

The FAA needs to own this. They downplayed legitimate concerns about privacy and safety. They put in place a standard that requires aircraft that are equipped to transmit ADS-B signals to keep transmitting even if they are outside the areas where such transmission is required. They ignored better approaches developed by ICAO for Europe.

1. The largest airports — think LAX, La Guardia, Sea-Tac. There are currently 37 Class B airports in the US.

2. Smaller but still busy, often with lots of jet traffic and regional scheduled service. Atlantic City NJ is a Charlie, as are Islip, Baton Rouge, and Sacramento.