Much of this was academic discussion until the Gatwick airport service disruption last week. Drones flying over the airfield interrupted schedules on Wednesday and Thursday, affecting 120,000 people. John Robb at Global Guerrillas posted on this, giving details on the disruption and drawing the lessons that people dedicated to causing chaos and disruption get out of the event.
I had an email last Friday asking if I thought it was possible to jam the drones and take them down. I said that when the dust settled from Christmas that I'd take a deeper look but that yes, as a general rule, any radio link can be jammed if you're willing to spend enough resources. If you're in charge of protecting a major airport, you should be spending that. On the other hand, if you want to disrupt the airport while making your drones jam resistant, there are very likely ways around the jamming.
The types of drones and their characteristics.
Jam resistance is achieved by using modulation modes that are less susceptible to jamming. For example, conventional FM is easy to jam over a limited area by putting a signal on the transmitter's frequency. I worked in an engineering lab once where one of the engineers hated another guy's favorite type of music. Every day at lunch, he would tune a signal generator to the FM broadcaster's frequency, put a short wire antenna in the output connector and turn up the generator's output. FM has what's called a "capture effect" where the stronger signal dominates the audio output and the unmodulated carrier from the signal generator silenced the audio output of the other guy's radio.
Likewise, if you're using a narrowband FM walkie talkie, a strong radio carrier on frequency can render FRS or amateur FM HT comm systems useless.
AM behaves differently and both the jammer and desired signal show up in the audio. All the signal generator could do is reduce the output audio volume. More advanced modulation techniques, broadly called spread spectrum, are more resistant to jamming. (Spread spectrum is when the signal's spectrum is much wider than the bandwidth needed to carry the information) Making your signal jam resistant has a good analogy to making a house more secure. You can do things to harden your home, but a determined attacker can still get it. You can spend more money and make it harder to get in, but you haven't made it impossible to get in, just much harder. Likewise, an attacker determined to spend any amount to make a signal jam resistant has a better chance than someone who can't spend very much. Cheap consumer electronics isn't going to be as jam resistant as military systems.
What I needed to find was the methods the nano drone market uses. It turns out, one of the test equipment and instrumentation giants in electronics, Rohde & Schwarz, published a white paper you can read online or download (pdf warning) with just this sort of information. This chart is a good summary.
The implications from the chart are that cheap hobby drones are most likely to use the 2.4 GHz ISM band (Industrial, Scientific, Medical) - better known as the WiFi band. They use Frequency Hopping Spread Spectrum (FHSS) or Direct Sequence Spread Spectrum (DSSS). FHSS is sending the information spread over different channels and then the channels are "reassembled" in the receiver. DSSS spreads the information across both frequency and time. (explanation) FHSS WiFi is fairly easy to jam, and cheap WiFi jammers are widely available - cheaper than a low end cellphone.
It implies that something that transmitted noise in the 2.4 GHz ISM band could jam the drones. It would also jam every WiFi link in the area. That would not be popular.
There's a bigger problem. What if the drone is not being controlled by some dork in the weeds at the end of the runway, but it's flying a GPS path programmed into it? Hobby drones can do that. Besides that, what if the drone is being flown by that dork and then you jam it. Then what happens? Does it land because it's no longer getting commands or does it have the GPS coordinates it took off from and now goes back to them? Going back along the line of flight would be a good safety procedure; assuming the drone has lost the signal simply because it went too far, have it fly back where it last had a useful signal. GPS can be jammed. That would cause the drone to be lost and perhaps land but jamming GPS would cause a major impact in the area.
Just because you jammed the signal doesn't mean your problems are over. Besides, if the drone operator is really trying to get their payload past whatever you can do, perhaps they could just change the radios to something they can get that isn't as likely to be jammed. The more non-standard it is, the better. That table says 5 GHz WiFi is used on drones - so it's too common.
Because of problems like this, there's an emerging and apparently fast growing industry in anti-drone technologies. Different technologies are being featured in a "dog fight" over who gets market share. Aside from that Rohde-Schwarz paper, Skydroner out of Singapore and Droneshield of Australia are examples of companies emphasizing physical security for your factory or other facilities.
Low cost drones are becoming a real security concern - during Trump's inauguration, the FAA closed the air space over DC, including closing to drones. There's no reason to think "drone free zones" work any better than gun free zones.
There is a Defcon talk about this. It is called "taking down my neighbor kid's cruddy drone" by Michael Robinson and it is available on youtube
ReplyDeleteperhaps they could just change the radios to something they can get that isn't as likely to be jammed.
ReplyDeleteLike a cell phone.
"isn't as likely to be jammed.
Deletelike a cell phone."
You're kidding, right??
https://www.thesignaljammer.com/
You knew that one of the antennae on every MRAP deployed in the sand box was a cell phone jammer to kill IED command detonation, right?
You knew that one of the antennae on every MRAP deployed in the sand box was a cell phone jammer to kill IED command detonation, right?
DeleteI didn't know that, but the criticism doesn't apply because the environment is different. Shutting down cell phone service at an airport is even worse of a denial of service attack than preventing airplanes from flying.
One late plane jams up arrivals and departures at 97 other airports, and affects tens of thousands of people worldwide.
DeleteYou missing out on streaming WWF in the departure lounge, or that order for an extra ton of widgets, not so much.
Nice try though. :)
Maybe that's what you do, but you have businessman working, people making hotel reservations, renting cars, arranging pickup, a million other things other than leisure. Cell phone jamming in the usa would be problematic. Second, I have more than a little bit of experience with those Iraq jammers. They don't work very far. The bubble around them is a couple hundred feet. Inverse law and all that. I know of several technologies that will defeat countermeasures that are available in the diy drone forums. Most are crude versions of what is used in tomahawk missiles. Comeandmakeit.
DeleteIn large rock can destroy a jet engine. A drone flying without any certain command, or direction, can do the same thing.
ReplyDeleteEvery passenger jet flying today is quite capable of flying with one engine out, assuming the cockpit crew is remotely competent. I would point you to ETOPS to help you understand. Drones or rocks ain't the only things what can take out an engine. And ICAO lets twin engine planes fly across the Atlantic. I think they are also permitted across the Pacific, but I'm not sure of that and am too lazy to do the research for you. The drone panic is a crock of shit perpetrated by Your Betters who want to make sure only the Right People can flit about with such things.
DeleteOf course, was there even any drone in the first place? There have been a number of reports, including by Only Ones, casting doubt on that.
Every passenger jet flying today is quite capable of flying with one engine out, assuming the cockpit crew is remotely competent.
DeleteGood point. A good rule to keep in mind is that aircraft and the systems they carry are designed to a Prime Directive (to borrow the Star Trek term): A Single Point Failure Shall Not Take Out the System. That certainly means A Single Failure Shall Not Take Down the Aircraft. Everything is redundant.
I believe twins are now the norm everywhere. There's only a couple of aircraft with four engines now: Boeing's 747, Airbus' A380, A340, and I'm sure I'm missing some. The new long range aircraft like the 787 and A350 are twin engine.
But losing an engine on takeoff, especially a catastrophic failure (complete engine stop, rather than just engine spooling down) can cause asymmetrical thrust issues, and if you trust your thrust to the computer, well, there's a long line of Airbus failures.
DeleteLandings are almost as bad, but takeoffs are an issue.
Captain Sullenburger, 4 aircrew, and 150 passengers on USAir 1549 would like a word with you all on your attitude towards the so-called "reliability" of dual-engine aircraft.
DeleteThe switch to 2 engines over 4 has been overwhelmingly solely to save fuel and maintenance costs on two extra engines, not to assure passenger safety, except by the most raggedy margin allowable by law.
If the FAA and NTSB would let them do it, the airlines would go to single engine jets, (and using hydrogen-lift Hindenburg zeppelins for local shuttle routes if it would save them 50¢/flight), until enough people died to get the multi-engine rule changed back.
The airlines have a long and distinguished history of doing the right thing, but only after exhausting all other possibilities.
Nice article. My thinking is that for a low investment, an airport can be shut down for a while and there isn't all that much that can be done about it.
ReplyDeleteLet's put more of the question into words where we can look at it. 'What can be done about these drone attacks, without also weakening the government mandates for centralization and control which demands the TSA and air traffic control as it presently exists?' Airplane traffic could be decentralized to use many smaller existing airfields, using a less-centralized air traffic control system. There have been proposals for this since the 90's. I think it was Eclipsejet who almost did it; multiple fare airplane service with multiple destinations like buses do. Passengers could board airplanes using this weird method called "steps", without gate rape.
ReplyDeleteArmies meeting for a duel out in the middle of nowhere, which is where a MRAP cell phone jammer fits in, is the biggest of big government programs. When pyramid building fails to excite, the next step is war. The goal is to impoverish the upper middle class officers and kill off the lower middle class enlisted so they cannot together compete and defend against the noble parasites. If a middle class person won't personally carry a gun, then all they will do is snitch and pay taxes. Except, so many middle class are no longer paying taxes by producing war materiel, they are doing government-mandated makework. This makes them a cost to government rather than an asset. Wrap city dwellers around government's neck like a millstone. What does the city produce that you need? Surgery?
@Anonymous 5:30
DeleteThey make a lot of firearms, microwaves, tractors, well pumps, generators, and washing machines out in the cornfields, do they?
We have a word for people who think the city is entirely superfluous: Amish.
They're a quaint anachronism and tourist draw, and only possible in a trust culture large enough to let them indulge in their Luddite predilections amidst a vastly larger culture.
They only become viable after a total global collapse - for the fifteen seconds until someone predatory comes along to kill their men, rape their women, and eat their children and crops.
Next idea.
One late plane jams up arrivals and departures at 97 other airports, and affects tens of thousands of people worldwide.
DeleteIf would-be passengers can't replan using their cell phones, the ripple effects are even worse.
They make a lot of firearms, microwaves, tractors, well pumps, generators, and washing machines out in the cornfields, do they?
Yes, almost. When is the last time you saw a current item marked 'Made in Los Angeles'? The factories are not in the city cores anymore, they are out by the ring Interstates in a different jurisdiction where the permitting is cheaper. These draw workers from the city, but are far enough away I don't think they are as vulnerable to mass unrest.
[Amish are] only possible in a trust culture large enough to let them indulge in their Luddite predilections amidst a vastly larger culture.
Amish have been carefully positioning themselves to be bad optics to oppress for over a hundred years. They have thrived too much to describe as having no defenses. I view them as a caterpillar that tastes bad. Yes, you can eat them. But you won't like the results, and all the predators know that.
A few thoughts:
ReplyDelete1. ETOPS is based on an airplane already in flight. Taking out an engine on a two-engine plane at takeoff can be deadly. Even taking out an engine on a four-engine plane at takeoff may be deadly. Witness the C-5 Galaxy that had a thrust reverser deploy at takeoff in Ramstein GE in 1990. Virtual Mirage (LL) has a book where an engine is taken out with a 50-cal at takeoff. Crash.
2. Use a directional antenna pointed at the drone to disable comms with the ground station. The drone should use GPS to navigate back to the launch point, or go into a loiter at the point of lost comms. Again, may be hard to determine proper frequency without jamming other systems...
3. GPS is, by design, hard to jam. And it is easy to find the jammer. The drone could implement other means of GPS-denied nav depending on design and skill of operator (triangulate on cell towers maybe)?
4. Probably easiest - high-power microwave directed at the drone to burn out electronics, IMHO...
5. If you can see the drone, why not an anti-drone drone? We can take down a ballistic missile with a direct hit from another missile (MDA/EKV). Why not hit the drone with another drone, especially from above, where the target should be blind.
Wandering Neurons
Even if the loss of an engine doesn't lead to catastrophe (and most of the time it wouldn't), the monetary cost of rebuilding or replacing the engine vs the cost of a new drone suggests an asymmetry of economics that would quickly bankrupt airlines in the face of persistent attacks. Additionally the revenue loss from people being less willing to fly in a high threat environment would likewise render airlines insolvent.
ReplyDeleteOf course, for my money I'd instead invest in other forms of attack. RPGs are cheap and abundant, can be used from stand off distances, guarantee casualties, and would be very effective against lumbering jets on the tarmac or predictable glide paths. One RPG attack per day at a random selection of airports would ground all commercial air traffic.
It should be evident that our very way of life depends on a low-threat environment nationwide. Border control and ruthless suppression of terrorist sects masquerading as religion are the indicated defense messure.
I think the takeaway from this is that for now a single drone near the departure end of a runway is a sufficient perceived threat to shut down an airport. It will take time and money to develop a countermeasure, which being by big gov, will be either monolithic and outflanked by the next drone denial of service, or an unenforecable blanket ban on hobby drones (in UK for sure, and possibly here). The threat will not go away however.
ReplyDeleteAgree with Anon 1:31; too many vulnerabilities with the potential of determined low risk/high return ops succeeding. I am surprised it hasn't happened yet/more often here.
ReplyDelete