Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Twitter trackers jeopardize military aircraft? (usni.org)
42 points by mzs on Sept 13, 2022 | hide | past | favorite | 85 comments


These "flight radar" sites work by tracking the ADS-B transponder data where the aircraft are actively broadcasting their position. This is used in civilian aviation to be able to more accurately tell the position, altitude, speed, heading etc. of planes (and avoid confusing random echos from rain etc. with planes).

If a military aircraft shows up on that, it's because they want to be seen, for example as a show of force. Once they don't want to be seen, they turn off their transponder, and disappear from those sites. Which is exactly what happened once SHTF in Ukraine.


Flightradar24 and most other only ADSB based tracking sites filter out the majority of military flights (I beleve). ADSBExchange (https://globe.adsbexchange.com/) on the other hand does not, they claim that if they have the data in the system it is public. And as you said, if the military don’t want to be seen they can just turn off their transmitters.

I live near a number of RAF and US Air Force bases in the UK. As far as I can see all RAF flights are visible on ADSBExchange. However, we quite often have US F16s fly over and they quite often are not tracked. So either they have permission here in the UK to turn off their transmitters (not convinced), there is a signalling issue, or ADSBExchange are filtering some data. It does appear to only affect US Air Force flight here though…


Yeah, filtering is one possibility.

They could also be switching the transponder to Mode 3 (equivalent to civilian Mode C) which is not ADS-B compatible but would still show up on normal normal civil radar scopes.

Or they can use some military only modes. Some of those could in theory be shown on civil scopes, but I'm not sure they actually are, while others like mode 4 or 5 cannot. But they could show up on the UK's military scopes, given nato intercompatibility.

Another theoretical option would be for the air force planes to be using mode-S, but having disabled mode-S extended squitter (which means the planes don't periodically broadcast their location, but simply only reply when interrogated by radar). I would expect ADS-B receiver to pick up on these periodic interrogations though. I'm not sure if interrogation responses are directional, but even if so, some receivers would probably be in the general direction of the radar site.

Its not really clear which. Outside of wartime, normal US Air Force policy is to fully integrate into the civil ATC system, except in special military use/training areas or certain special missions. This integration just makes things safer for everybody.


They have to set the IFF system to the OFF position.


> If a military aircraft shows up on that, it's because they want to be seen, for example as a show of force.

There were B-52s doing orbits over Kabul during the evacuation with their transponders turned on.


> B-52s doing orbits over Kabul during the evacuation with their transponders turned on

These transponders’ primary goal is preventing collisions. America never lost air superiority over Kabul. Keeping transponders on reduces the risk of collisions amid chaos at the cost of dialling up the non-existent risk of detection by Taliban SAMs.


Based on my Dad having worked on such a thing in the early 1960s, surely they have encrypted/spread-spectrum versions of such things?


> surely they have encrypted/spread-spectrum versions of such things?

Kabul’s airspace was a mess of civilian and military planes [1][2]. You want the Spanish A310 to know it’s barrelling towards a Superfortress.

[1] https://en.m.wikipedia.org/wiki/2021_Kabul_airlift

[2] https://twitter.com/defencegeek/status/1427012384502292480?s...


Perhaps related [1]. In this case, these transmitters would have prevented the collision. It may seem crazy, but a collision with a large military aircraft out in the middle of nowhere has happened before.

>Neither aircraft was equipped with TCAS collision avoidance systems, and although both crews had filed a flight plan, the German aircraft was not in contact with Namibian air traffic control and controllers were unaware of its presence in Namibian airspace. Furthermore, the Tupolev was flying at the wrong altitude, according to its flight plan and to the semicircular rule.

[1] https://en.wikipedia.org/wiki/1997_Namibia_mid-air_collision


Perhaps, but that doesn't help with collision avoidance if commercial and private craft in the area do not.


If the security of your military operations are vulnerable to "random nobodys running bots that post on Twitter," your operations aren't secure in the slightest, because any slightly competent adversary can do exactly the same thing - and they probably already were.

If you're on a sensitive military operation and are broadcasting anything - not just ADS-B, but any sort of radio emissions - someone will notice you. Radio blackouts have been a part of secret operations for a long, long while.

Either you're broadcasting and therefore don't care who knows you're there, or you care to not be detected and don't broadcast anything. Those are the options.

Twitter has nothing to do with it.


> If the security of your military operations are vulnerable to "random nobodys running bots that post on Twitter," your operations aren't secure in the slightest, because any slightly competent adversary can do exactly the same thing - and they probably already were.

Which is the exact message of the OP:

> Adversaries no longer need to rely on expensive radars to find U.S. military aircraft. The accessibility of this information demands a review of U.S. military operational security practices....

> Compromise Needed

> The information adversaries can derive from unsecured aviation data is far too revealing of mission-critical operations and movements. The Department of Defense (DoD), FAA, and other stakeholders need to reach a compromise that better balances aircraft safety and operational security. This agreement also should be coordinated with international air safety organizations such as the European Union Aviation Safety Agency and perhaps NATO as a standard operating procedure. A possible compromise could entail a peacetime mode in which ADS-B altitude and bearing data is transmitted but identifying information harmful to operational security is stripped out and a wartime mode in which DoD reserves the right to turn off ADS-B transponders in the vicinity of conflict zones.

There's tension between the needs of civilian air safety and military operational security. You don't want your military aircraft tracked, but you also don't want airliners colliding with them, either.

> Twitter has nothing to do with it.

Twitter demonstrates the problem in an eye-catching way.


Inventing a problem that doesn’t exist.

Military aircraft have controls on their dashboards for turning individual systems off as required. Turning off ADS-B would be the first thing on the checklist for sensitive flights, and one of the things that are turned on purposefully when entering friendly airspace.

It would surprise me if military transponders do not have the ability to broadcast “I am a Cessna at 3000ft” regardless whether the actual aircraft is a F35 or a Galaxy.

cf the usual copypasta about the SR-71 crew asking ATC for an altitude and speed reading. They use the broadcast radio systems because they want you to know they’re there.


> Military aircraft have controls on their dashboards for turning individual systems off as required. Turning off ADS-B would be the first thing on the checklist for sensitive flights, and one of the things that are turned on purposefully when entering friendly airspace.

Yeah, of course, but that doesn't mean there still isn't an issue. If you read the article, you'd see that it was talking about stuff like military aircraft having their transponders on in friendly airspace over countries like Germany.


> Twitter demonstrates the problem in an eye-catching way.

To the populace, sure it’s “visible” now. But adversaries are just doing what they’ve always done - why rely on Twitter, which could be censored by the USA.


I wonder how effective such tactics really are. Surely you know which airport the plane came from and where it went. And then can have estimation of speed, acceleration and climb rates. Giving somewhat a picture of type of craft used.


Assuming the data is from ADS-B, you have real-time location data. Of course, it's self-reported, so won't be always be available.


Ok but you don’t have to do the heavy lifting _for_ them. Make them do the hard work and we’ll probably “smoke some out” to recycle a line by one our colloquial yokel ex-presidents once said.


It's not heavy lifting. It's not hard work. It's turning on a radio receiver.


Heavy or light, let them do the work. Don't do it for them.


If military security can be defeated by someone with a $20 dongle and a raspberry pi, they should find a different strategy, not kindly ask people to protect them.


Or, given that there isn't any stealth to be had, you inject some noise into the system to deflate the value of the intelligence.


I always use the third option: broadcast fake data


Very little to do with twitter, and a lot to do with ADS-B data, which anyone in the vicinity of the aircraft can track and post online using a $15 device.


If you are tracking then you know this has changed dramatically in the last few years. In the US the FAA ruled that local / state / federal orgs can turn it off in the case of sensitive operations.


You can tell this is garbage because they sensationalize the headline by making it about Twitter, but only once you read halfway through the actual article they're actually talking about making public-domain ADS-B data available on the internet in general.


The Twitter anecdote serves to demonstrates that it's a very visible problem, rather than being some data hidden away in a dark corner of the internet. That is something reasonable to illustrate to a non-technical audience.

You don't want to just jump straight to "ADS-B transmitters" right off the bat when speaking to a non-technical audience, because they have no idea what that means or what the implication is. Leading with "your info could end up on Twitter" provides the foundation for why a non-technical reader should care about the rest of the article.


Considering that the article was written by a General, and posted on USNI, I'm inclined to believe the title is intentionally antagonistic. If the title was more neutral, such as explaining that the data is publicly available, and affects more than just US aircraft, it wouldn't be an issue. Something like, "Publicly Available ADS-B Data Reveals Locations of Military Aircraft". Calling out Twitter is not necessary; It's ADS-B's fault, not Twitter.


It got your attention, which is more likely the point. A well-known, visible “adversary” was needed and since a lot of the trackers post on Twitter, it’s ready-made for such a thing. If they posted more on Instagram, same thing.


Wonder why they would do that... almost like there is a campaign against Twitter right now. Wonder if there is anything going on where they would want to try to sway public opinion about Twitter at this point in time.


My impression was that military aircraft turned off their transponders all the time, especially during sensitive parts of their missions. You don't have to follow any of the OSINT accounts that post flight info to see posts about how some Global Hawk re-emerged on the trackers, after having gone silent some number of hours ago. Sometimes they keep their transponders on, intentionally, to communicate intent and posture to potential adversaries.


Military aircraft frequently operate with ADS-B off even here in the US. The whole premise is nonsense. If a military aircraft is being seen on ADS-B it's because they want to be seen. I think the author is trying to make a point about tracking movements to and from foreign nations, overseas bases, etc. but sometimes the point is to let them know you're coming.


The opening story about a missile launch is fabricated but the author doesn’t make that clear at any point.

There’s a reason the DOD aren’t in objection to ADS-B transponders but it’s above the civilian author’s security clearance level to know the reason.


> ... civilian author's ...

Hmm... the author is listed as: "Gunnery Sergeant Andrew Guthart, U.S. Marine Corps", which does not sound civilian to me. Civilians usually don't have military titles.


Are they posting as an official voice of the US DOD? Or are the posting with a title in the hope that associating themselves with the military gives them more authority? Are they identifying their rank so other defence people reading the article will understand that a gunnery sergeant might not be appraised of the relevant information?


If they didn’t want to be tracked they could just turn off their ADS-B transponders


They still want the local traffic to see them; this is like twitter exposing messages on your LAN to the Internet.


Is it not data already publicly posted elsewhere already on the internet? This isn't specifically a Twitter thing.


Sure my bad; this is like someone on your LAN publishing your network traffic on the internet and twitter making it searchable and easier to catalogue.


You've yet to mention or acknowledge any of the other easily searchable catalogues of this data (see the several links and mentions in other comments) as being a problem. Why just Twitter?

If you have a problem with this data being public, that's not a Twitter issue, that's a policy issue which will affect several companies (and if that's what you think, that's fine). If you think this data should be public, just not on Twitter, what sense does that make?

There aren't many analogies that have any use beyond sounding pithy. They fall over at the slightest bit of scrutiny. I don't think this LAN one is much of an exception. Data that is public by default shares little relation to traffic on my LAN. Just say what you mean. Don't want the data to be public? Sure, I think that'd be interesting to talk about. Just don't like Twitter? Also cool, though not as interesting.


Hey man, I'm not the author; You can take your gripes up with FAA and the navy. I'm just knowledgeable about what's happening and why.


Anyone in the area can receive it also with a $10 stick from aliexpress and a phone or a computer :)

Hiding this is only hiding the problem, not improving actual security.


And the article acknowledged it, in the way of not suggesting that perhaps some transponder data shouldn't be broadcasted at all.


People who need less visibility can transmit a different registration or just turn off the various transponders.


Do you? If you're in a war zone, then "local traffic" consists on enemy jets, and inbound missiles.

If your military aircraft isn't in war zone, then how much do you really care about other people in the world picking up your ADS-B transmissions? After all, they can just turn the transponder off, and take on all the responsibility of dodging other aircraft.


This isn't just about active war; even the article focuses on support missions in conflict zones. VIP transport is also sensitive movement.

They already have some resolution for this https://www.faa.gov/air_traffic/technology/equipadsb/privacy


Then they'd have to shut down FlightRadar. And FlightAware...


Those do filter out military flights and anybody else who asks (e.g. millionaires with private jets).

ADSBExchange.com does not, I always use that as it's completely free and fully powered by volunteers. They don't do any filtering or add artificial delays. Recently they've even added MLAT reception of pre-ADSB flights (needs quite a bit of coverage in the area though!)


> Those do filter out military flights and anybody else who asks (e.g. millionaires with private jets).

Asked directly they try to refuse as long as they can. However, they seem to use the block list maintained by the FFA. Sign ip now through a new convenient online form [0]. The seem to accept non-N registered, too.

ADSBexchange continues to refuse, but there's still some hope. FAA adding convenience to their process shows the pressure is rising.

[0] https://www.faa.gov/pilots/ladd/request/


A better bad tech analogy would be slurping up SSIDs like Google does for location data.


You mean someone on your LAN exposing messages to the twitter/internet?


>They still want the local traffic to see them

Why?


So that they don't crash into them.


Cannot military aircraft see others and avoid them themselves instead of letting other know about them?

And military would have encrypted insider communication between eachother

It may be naive question cuz I never operated such a thing


Transponders make radar much easier. No need for active radar


no need for active radar. just have your guys at base watch your flight path and route you safely. this way you can deactivate your transponder and still be not of danger to anyone around you. I’d imagine this is how they to it


Every airport with radar has active radar, so they're going to "see" you anyway even if the people hoovering up ADS-B info don't.

And yes, there are people who have cameras pointed at the sky all over the country, and with software that says "I see a plane, and I don't see no ADS-B".

Combine https://www.tomshardware.com/how-to/raspberry-pi-airplane-tr... with https://medium.com/swlh/automated-meteor-aircraft-satellite-... and you're golden.


>just have your guys at base watch your flight path and route you safely

Then you have to rely on a human element, which is a horrible idea in a rapidly changing environment.

Imagine someone hits the base and takes out its comms. You no longer have any idea where anyone is.


And they do, at least over here in Europe right now.


The article mentions that. [1]

[1] https://news.ycombinator.com/newsguidelines.html Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."


This may win the award of most passive-aggressive citation I've seen on HN this week, which is impressive. Exemplar case of following the letter, rather than the spirit, of the rule.


Thank you! I tried! :)


Any reasonably sensible adversary can also just run their own ADS-B receiver. In fact, literally anybody can do this.

Shutting down the twitter bots will help absolutely nothing, just hide the problem.


> Shutting down the twitter bots will help absolutely nothing, just hide the problem.

Nobody suggested that.


Oh ok, I thought this was the usual attack piece on the ADS-B tracking community that comes up a lot. Recently it came up again with the celebs being called out for stupid trips.

I agree stripping some info from ADS-B might help and I saw that suggestion in the article, but also that is IMO just a piece of security theater. Serious adversaries will know what it is.


What is the article even talking about? Earlier in the war, you could clearly see US KC-135 Stratotankers flying from the UK to the Polish/Ukrainian border and then flying along the border.

Now, I guess the USAF isn't flying fuel stations around just for the heck of it - there will be fighter jets or surveillance drones alongside the tankers feeding from them, but with their ADSB transponders switched off.

Same with FORTE10/11 - they just appear on ADSB trackers somewhere over Greece, fly out over the Black Sea and then vanish. Transponders switched off.


Just to add to that a bit: early in this conflict there were airborne tankers flying in patterns near the border, along with V-22 Osprey aircraft. All with ADSB transponders on. Periodically the Ospreys would disappear from ADSB for a few hours and then return. No flight path to suggest they were landing somewhere, they just disappeared. The assumption by folks monitoring this stuff on twitter is that they were shutting off their transponders, going over the border into the Ukraine, and picking up US personnel (embassy staff likely). Then when they came back over the border they’d turn the transponder back on.


Forte10/11 has been patrolling with trackers on for all to see. I watch it regularly.


So which billionaire paid for this propaganda. Looking forward to national security being used as a talking point when they try to pass a law banning this.


The real danger is the lack of technical literacy in the world.


The real question is: dangerous to whom?


Anyone who uses the internet, for one.

Have you ever listened to congressional hearings related to tech? Folks from congress have no idea what's going on. They're focused on the wrong issues, ask insane questions, and at the end of the day are responsible for regulating the industry. If things don't change, we're going to end up in an even worse spot when it comes to online privacy, security, etc etc etc.


Information for nearly anything and everything is available somewhere if one knows where to look or has the “creativity” to obtain said information oneself. As many have commented twitter is just the mass discovery vector that those who did not know how to find this particular type of data are now made aware from a tweet. With plane spotting as my back deck hobby, along with my proximity to interesting aircraft, for years I have spelunked the web to find better sources given that some tracking services are paid by aircraft owners to remove their data. Another option is the secondary data that relates to air travel designating restrictions for VIPs, mainly political of course. Fitting timing on this hn inquiry as just yesterday our area had an out of band flight restriction in the afternoon for several hours which was for 46, or an immediate family member, from past correlation to data and news events. Then last evening nearing the conclusion of the flight restriction the house was shaking from Air Force One having just taken off from New Castle Delaware and flying nearly right over our house at what seemed like full throttle climbing through to altitude. As with anything, data can be the problem or the solution, it just depends on one's intent.


Isn't this more of a point about OSINT as a whole? just practice better OPSEC and it becomes less of a problem, and from my semi-uninformed position I think its always possible to _somehow_ disable tracking/transponders, be it ADS-B or AIS.

That being said, it was pretty interesting to track military aircraft flying around during the opening weeks of the war


And on top of all of the fears expressed by Gunner Sergeant Andrew Guthart, there is serious discussion of using ADS-B in place of active radar at many airports.

With the high visibility of ADS-B you’d have thought that someone in US DOD would have thought about this newfangled radio stuff and perhaps put some controls in front of one of the people operating the aircraft to allow turning off radios or spoofing the ID on transponders.

“Hello fellow civilian aircraft I am a Cessna flying at 3000ft ground speed 75knots 45 magnetic” says the C5 in an attempt to camouflage the sensitive operational flight through civilian airspace before entering the war zone.


Propaganda piece commissioned by a private jet owner who does not like Twitter.


Encryption would not change anything. Position is calculated by triangulation. All this needs is some unique data to put the pieces of the puzzle together.

What would be missing with encryption is identification. However, knowing where something took off from and how it behaves in the air provides enough information.

The solution is much easier. My flight track is my intellectual property. DMCA take-down.

Might even outsource this job. Fly the shape of Mickey Mouse and let Disney work on the take-downs.


> Fly the shape of Mickey Mouse and let Disney work on the take-downs.

Not sustainable. Mickey Mouse enters public domain on January 1, 2024.


> These social media posts gather open-source information from multiple plane tracking websites that can access unencrypted aircraft transponder data

> Adversaries no longer need to rely on expensive radars to find U.S. military aircraft.

Wait… so which one is it? Can you get this information from public websites, or only with expensive radar equipment? Clearly, it’s the former and even if it were the latter, it’ll only stop the poorest adversaries. Twitter is just the bull horn.


Note: this website seems completely independent from the US government, despite its official appearance.


Probably obvious, but anyone seriously wanting to track that data isn't going to go to Twitter about it. They are going to the tracking sites to get the data directly, mining it for all it's worth.


Why does military aircraft broadcast that data?

Why it's unencrypted?

How does radar see those aircrafts?


> Why does military aircraft broadcast that data?

For coordination with civilian aircraft.

> Why it's unencrypted?

See above.


When flying like a civilian plane, for coordination with air traffic control.

Otherwise, to tell everyone, including the enemy, that they're there, as a show of force.


I don’t understand what this has to do with twitter




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: