Undermining Privacy in the Aircraft Communications Addressing and Reporting System (ACARS)

Open access

Abstract

Despite the Aircraft Communications, Addressing and Reporting System (ACARS) being widely deployed for over twenty years, little scrutiny has been applied to it outside of the aviation community. Whilst originally utilized by commercial airlines to track their flights and provide automated timekeeping on crew, today it serves as a multi-purpose air-ground data link for many aviation stakeholders including private jet owners, state actors and military. Such a change has caused ACARS to be used far beyond its original mandate; to date no work has been undertaken to assess the extent of this especially with regard to privacy and the various stakeholder groups which use it. In this paper, we present an analysis of ACARS usage by privacy sensitive actors-military, government and business. We conduct this using data from the VHF (both traditional ACARS, and VDL mode 2) and satellite communications subnetworks. Based on more than two million ACARS messages collected over the course of 16 months, we demonstrate that current ACARS usage systematically breaches location privacy for all examined aviation stakeholder groups, explaining the types of messages used to cause this problem.We illustrate the challenges with three case studies-one for each stakeholder group-to show how much privacy sensitive information can be constructed with a handful of ACARS messages. We contextualize our findings with opinions on the issue of privacy in ACARS from 40 aviation industry professionals. From this, we explore recommendations for how to address these issues, including use of encryption and policy measures.

[1] C. Adams. Securing ACARS: Data Link in the Post 9/11 Environment. Avionics Magazine, pages 24-26, June 2006.

[2] Aeronautical Radio Inc. (ARINC). DataLink Security, Part 1 - ACARS Message Security. Technical Standard 823P1, 2007.

[3] Aeronautical Radio Inc. (ARINC). Aircraft Communications Addressing and Reporting Systems (ACARS). Technical Standard 724B-6, 2012.

[4] Aeronautical Radio Inc. (ARINC). Datalink Ground System Standard and Interface Specification. Technical Standard 620-8, 2014.

[5] Airline Pilots Association. Aviation Cyber Security: The Pilot’s Perspective. Technical report, Air Line Pilots Association Int’l, Washington, 2017. URL https://www.rtca.org/sites/default/files/symposium_2017_cybersecurity_white_paper_digital.pdf.

[6] B. Blanchet. Symbolic and Computational Mechanized Verification of the ARINC823 Avionic Protocols. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pages 68-82, Aug 2017. 10.1109/CSF.2017.7.

[7] J. Bourn. Royal Travel by Air and Rail. Technical report, United Kingdom National Audit Office, London, 2001. URL https://www.nao.org.uk/wp-content/uploads/2001/06/010225.pdf. Retrieved on 2017-01-18.

[8] J. Drew. Managing Cybersecurity Risks, 2012. ISSN 00218448.

[9] Eurocontrol. Aircraft Equipage Requirements in the European Commission IRs 1207/2011 and 1028/2014, 2017. URL https://www.eurocontrol.int/spi-ir.

[10] European Parliament. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals With Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995.

[11] European Parliament. Regulation 2016/679 of the European Parliament and the Council of the European Union of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016.

[12] Federal Aviation Administration. Access to Aircraft Situation Display (ASDI) and National Airspace System Status Information (NASSI), 2011. URL https://www.federalregister.gov/documents/2011/03/04/2011-4955/access-to-aircraftsituation-display-asdi-and-national-airspace-system-statusinformation-nassi. Retrieved on 2017-01-22.

[13] Federal Aviation Administration. Equip ADS-B, 2016. URL https://www.faa.gov/nextgen/equipadsb/. Retrieved on 2016-07-25.

[14] Federal Office of Civil Aviation FOCA. Swiss Aircraft Registry, 2017. URL https://www.bazl.admin.ch/bazl/en/home/specialists/aircraft/swiss-aircraft-registry.html. Retrieved on 2017-02-28.

[15] FlightAware. FlightAware, 2017. URL https://www.flightaware.com/. Retrieved on 2017-03-06.

[16] FlightAware. Global Flight Tracking, 2017. URL http: //uk.flightaware.com/commercial/global. Retrieved on 2017-10-19.

[17] FlightAware. Frequently Asked Questions, 2018. URL https://uk.flightaware.com/about/faq#military.

[18] Flightradar24 AB. Flightradar24, 2017. URL https://www.flightradar24.com. Retrieved on 2017-10-06.

[19] Flightradar24 AB. Flightradar24 FAQs, 2018. URL https: //www.flightradar24.com/faq. Retrieved on 2018-03-15.

[20] O. Gurtovaya. Maintaining Privacy in a World of Technological Transparency: The BARR Program’s ups and downs in Changing Times. Journal of Air Law and Commerce, 77: 569-603, 2012.

[21] D. Hoffman and S. Rezchikov. Busting the BARR: Tracking “Untrackable” Private Aircraft for Fun & Profit. In DEF CON 20, Las Vegas, 2012. URL https://www.defcon.org/html/defcon-20/dc-20-speakers.html#DHoffman.

[22] International Civil Aviation Organization. Data linkautomatic Terminal Information Service (D-ATIS). In Annex 11 to the Convention on International Civil Aviation - Air Traffic Services, chapter 4, pages 4-4. 13th edition, 2001.

[23] International Civil Aviation Organization. Guidance Material on Advice to Military Authorities Regarding ADS-B Data Sharing, Sept. 2012.

[24] International Civil Aviation Organization. Automatic Dependent Survey - Contract (ADS-C). In Global Operational Data Link Document (GOLD), chapter 2, pages 2-46. 2nd edition, 2013.

[25] N. B. Kalinowski. Access to Aircraft Situation Display to Industry (ASDI) and National Airspace System Status Information (NASSI) Data., 2012. ISSN 00976326. URL http://search.ebscohost.com/login.aspx?direct=true&db=bth&AN=75291461&site=ehost-live.

[26] M. Kirby. How Ryanair monitors health of Boeing 737s without ACARS, 2014. URL https://runwaygirlnetwork.com/2014/09/06/how-ryanair-monitors-health-of-boeing-737s-without-acars/. Retrieved on 2017-11-29.

[27] P. Kleberger, T. Olovsson, and E. Jonsson. Security Aspects of the In-vehicle Network in the Connected Car. In Intelligent Vehicles Symposium (IV), 2011 IEEE, pages 528-533, June 2011.

[28] R. D. Kloth. Airframes.org, 2016. URL http://www.airframes.org/. Retrieved on 2017-02-14.

[29] T. Leconte. ACARSDec ACARS Decoder, 2015. URL http://sourceforge.net/projects/acarsdec/. Retrieved on 2016-12-08.

[30] M. Maremont and T. McGinty. FAA Is Set to Give Investors a Peek at M&A Air, 2011. URL https://www.wsj.com/articles/SB10001424052702303499204576389923856575528.

[31] National Business Aviation Administration. Blocking display of Aircraft Situation Display to Industry (ASDI) data, 2016. URL https://www.nbaa.org/ops/security/asdi/.

[32] National Security Agency. Commercial National Security Algorithm (CSNA) Suite, 2015. URL https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for-classified/algorithmguidance/commercial-national-security-algorithm-suitefactsheet.cfm. Retrieved on 2017-02-21.

[33] NATS. Airspace Explorer FAQs, 2017. URL https://www.nats.aero/ae-home/faqs/. Retrieved on 2017-11-24.

[34] R. T. Oishi and A. Heinke. Data Communications. In C. R. Spitzer, U. Ferrell, and T. Ferrell, editors, Digital Avionics Handbook, chapter 2, pages 2.7 - 2.13. CRC Press, 3rd edition, 2015.

[35] R. T. Oishi and A. Heinke. Air-Ground Communication. In C. R. Spitzer, U. Ferrell, and T. Ferrell, editors, Digital Avionics Handbook, pages 2.1 - 2.3. Taylor & Francis Group, third edition, 2015.

[36] J. Olds. JAERO, 2017. URL https://github.com/jontio/JAERO. Retrieved on 2017-05-08.

[37] K. Pascoe. ACARS and Error Checking, 2015. URL http://www.flight.org/acars-and-error-checking. Retrieved on 2017-11-07.

[38] I. Rouf, R. Miller, H. Mustafa, T. Taylor, S. Oh, W. Xu, M. Gruteser, W. Trappe, and I. Seskar. Security and Privacy Vulnerabilities of In-car Wireless Networks: A Tire Pressure Monitoring System Case Study. In Proceedings of the 19th USENIX Conference on Security, USENIX Security ’10, pages 21-21, Berkeley, CA, USA, 2010. USENIX Association.

[39] A. Roy. Security Strategy for US Air Force to Use Commercial Data Link. In 19th Digital Avionics Systems Converence, pages 1-8, Philadephia, 2000. IEEE Computer Society. ISBN 0780363957.

[40] A. Roy. Secure Aircraft Communications Addressing and Reporting System (ACARS). US Patent 6677888, 2004.

[41] K. Sampigethaya and R. Poovendran. Flight Privacy in the NextGen: Challenges and Opportunities. In Integrated Communications, Navigation and Surveillance Conference (ICNS), 2013, pages 1-15, Apr. 2013.

[42] K. Sampigethaya, R. Poovendran, S. Shetty, T. Davis, and C. Royalty. Future E-enabled Aircraft Communications and Security: The Next 20 Years and Beyond. Proceedings of the IEEE, 99(11):2040-2055, 2011.

[43] M. Schäfer, V. Lenders, and I. Martinovic. Experimental Analysis of Attacks on Next Generation Air Traffic Communication. Lecture Notes in Computer Science, 7954 LNCS: 253-271, 2013. ISSN 03029743. 10.1007/978-3-642-38980-1_16. URL http://link.springer.com/chapter/10.1007/978-3-642-38980-1_16.

[44] M. Schäfer, M. Strohmeier, V. Lenders, I. Martinovic, and M. Wilhelm. Bringing Up OpenSky: A Large-scale ADS-B Sensor Network for Research. IPSN 2014 - Proceedings of the 13th International Symposium on Information Processing in Sensor Networks (Part of CPS Week), pages 83-94, 2014.

[45] M. Schäfer, M. Strohmeier, M. Smith, M. Fuchs, R. Pinheiro, V. Lenders, and I. Martinovic. OpenSky’s Report 2016: Facts‚ Figures and Trends in Wireless ATC Communication Systems. In 35th Digital Avionics Systems Conference - Proceedings. IEEE/AIAA, 2016.

[46] M. Smith, M. Strohmeier, V. Lenders, and I. Martinovic. On the Security and Privacy of ACARS. In Integrated Communications Navigation and Surveillance Conference (ICNS), Herndon, 2016.

[47] M. Smith, D. Moser, M. Strohmeier, V. Lenders, and I. Martinovic. Analyzing Privacy Breaches in the Aircraft Communications Addressing and Reporting System (ACARS). ArXiv e-prints, May 2017. URL https: //arxiv.org/pdf/1705.07065.pdf.

[48] M. Smith, D. Moser, M. Strohmeier, V. Lenders, and I. Martinovic. Economy Class Crypto: Exploring Weak Cipher Usage in Avionic Communications via ACARS. In 21st International Conference on Financial Cryptography and Data Security, Malta, 2017.

[49] P. E. Storck. Benefits of Commercial Data Link Security. In Integrated Communications, Navigation and Surveillance Conference, ICNS, Herndon, 2013. IEEE.

[50] M. Strohmeier, M. Schäfer, R. Pinheiro, V. Lenders, and I. Martinovic. On Perception and Reality in Wireless Air Traffic Communications Security. 2016. URL http://arxiv.org/abs/1602.08777. Retrieved on 2016-10-05.

[51] M. Strohmeier, M. Smith, M. Schäfer, V. Lenders, and I. Martinovic. Assessing the Impact of Aviation Security on Cyber Power. In Cyber Conflict (CYCON), 8th International Conference on. IEEE, 2016.

[52] M. Strohmeier, M. Smith, V. Lenders, and I. Martinovic. The Real First Class? Inferring Confidential Corporate Mergers and Government Relations from Air Traffic Communication. In IEEE European Symposium on Security and Privacy (EuroS&P) 2018. IEEE, Apr. 2018.

[53] J. Sun. World Aircraft Database, 2016. URL http://junzisun.com/adb/. Retrieved on 2016-11-05.

[54] H. Teso. Aicraft Hacking: Practical Aero Series. In 4th Hack in the Box Security Conference in Europe, Amsterdam, April 2013. URL https://conference.hitb.org/hitbsecconf2013ams/materials/D1T1-HugoTeso-AircraftHacking-PracticalAeroSeries.pdf. Retrieved on 2017- 01-13.

[55] C. Trautvetter. FltPlan Flight Privacy Program Exposes Tangled FAA Policy, 2011. URL https://www.ainonline.com/aviation-news/aviation-international-news/2011-08-31/fltplan-flight-privacy-program-exposes-tangled-faapolicy. Retrieved on 2017-10-24.

[56] T. Webster. FAA: List of Blocked Aircraft (BARR List/ASDI Block List), 2017. URL https://www.muckrock.com/foi/united-states-of-america-10/faa-list-of-blockedaircraft-barr-listasdi-block-list-34713/. Retrieved on 2017- 10-27.

[57] J. Wolper. Security Risks of Laptops in Airline Cockpits, 1998. URL http://catless.ncl.ac.uk/Risks/20/12#subj4. Retrieved on 2017-02-17.

Journal Information

Metrics

All Time Past Year Past 30 Days
Abstract Views 0 0 0
Full Text Views 1012 823 64
PDF Downloads 417 389 16