Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

> sufficient product telemetry is indistinguishable from surveillance malware

Isn't this mandatory given the restrictions required of them to disallow flying in banned areas?



sort by: page size:

> Most networks like Flight Aware allow owners to blacklist aircraft such that their tracks do not appear on the site.

Do you know more about how this is done? Is there a fixed price list for this service? Can one "buy" it online? Is there some sort of registry that is shared between networks?

> Additionally military aircraft are typically not reported.

While I'm sure the military can turn off transponders at will, I presume (?) they often fly with them on. Can these signals be tracked with "standard" gear when they are on?


>Even companies like FlightAware and FlightRadar24 rely on hobbyists to receive this data.

Businesses blatantly operating in violation of EU laws might not be the best example here.


> how do you distinguish 'telemetry' from 'surveillance'?

Granularity. Telemetry data can be privacy-respecting (e.g. anonymously aggregated) while still being useful.

E.g. "143 people flew from NYC to LA this month" vs. "John Smith flew from NYC to LA at 2:00 pm on Tuesday."


More importantly, I think they are trying to avoid giving any incentive to hack a plane mid-flight. The policy also stated that criminal actions may be persued in cases of attempting to access these systems.

> would prevent persistent tracking of for example private jets

Why? They are using our airspace. Looking down in to our backyards. I have a right to at least get an identifier I can use to report to authorities.

I've worked with VVIP executive protection teams before and if the trip needs to be secret they will schedule plane swaps along the trip or rent a jet that is not attributable to the company.


> His program uses public data sources including the Federal Aviation Administration, OpenSky Network, and Automatic Dependent Surveillance–Broadcast.

https://en.wikipedia.org/wiki/Jack_Sweeney#Creation_of_fligh...


>1. Flight tracking data, collected from ADS-B, is legal and publicly available. Aircraft ownership data is public too.

Not legal in Europe. You can't legally collect this (or any other PII) for fun, you'd need particularly strong reasons to do so without consent.

Mobile phones also broadcast their IMEIs and location, it would be similarly illegal to collect and store those signals to track phone movements.

>2. Nobody has a right to keeping their aircraft movements private, and aircraft movements != personal movements.

While not all aircraft movements are personal movements, many are.


> How is this different then doxing?

Because it's public information that's literally broadcast to anyone listening by every aircraft above a certain size/speed. This isn't information that is considered secret or even that one needs to dig to expose, the aircraft is actively transmitting regular messages containing its location, heading, and speed to anyone within radio range which can be tens or hundreds of miles depending on altitude.


You say that as though the people deploying things like this[1] care much about false positives...

[1] No fly lists, for example.


Respectfully: the pilots have been doing an absolutely excellent job with it for decades without us having to destroy their privacy.

An argument can easily be made that this extra stress will make flying less safe.

Edit: my next car will probably have mandatory spyware and unlike pilots there won't be a guaranteed no blame process if something happens. It is pretty easy to see how this will be abused by insurance companies and data harvesters.

I think I kind of understand the processes that lead to this. But I seriously wish tech people wouldn't be accepting it and even argue for it.


I was thinking of this exact talk. IIRC, He never gets a hold of the more expensive plane-to-plane transmitters and of course, he wouldn't transmit anything on them if he did, but he does bring up a lot of concerns and I'm wondering what the FAA and other countries orgs have in place to detect malicious signals, track them and stop/arrest them.

Realistically, those are probably still useful in situations like this, because the authorities can more easily filter out compliant air traffic when they're trying to monitor/investigate something like this. Without it, they'd need to find the needle in a much bigger haystack.

Point being, if the aircraft is looking at private residences using sensors that reveal things that couldn't ordinarily be perceived by humans, its activities may be legally iffy.

But that's what parallel construction is for, I guess...


That should've been obvious.

To be fair, from what I understand the no fly zone restrictions thing actually does require geolocation lookup and I think those no fly zones can change, so pinging a server and checking in makes sense.

From just a pure telemetry perspective, knowing where people are flying the drones at is useful for product development and marketing.

(In response, DJI did release a privacy mode that doesn't need internet.)

A sizable % of websites visited want geo-location data, which, at times, gets sold on the open market!

Then there are background phone apps that grab location data. Even when rate limited, once every half an hour is plenty enough to figure out where Military Secret is at.

Infosec, it is a thing for a reason.


> If you want privacy, owning an aircraft is not the way to go. Renting or chartering one might be better against casual observers, but there is still a paper trail. You may be able to add some more levels of indirection.

But that paper trail cannot be accessed through ADSB. If you charter a plane, there's no way someone can deduct who you are via ADS-B signals alone. And agencies with access to the paper trail don't need ADS-B to know where you went.


Well, there's a slight difference between "flying these things for real testing" and being carted around on a flatbed where yahoos with a smartphones are around to take videos and post them.

Presumably, if it actually requires some level of security clearance, either it should have been covered for transport, or the yahoos with smartphones should have been cleared of the area to at least reduce the chance of something silly like this.

Not a whole lot you can do if you need to fly it and it's going to be in or around public areas, nor much you can do about satellite imagery, but that doesn't mean ignore all opsec.


There is no need for a pilot to be able to disable tracking on a commercial plane.

They should position the tracking hardware outside the plane making it relatively tamper-proof mid flight.


> The information is publicly available because it is mandated to be as a condition of flying.

No, it's not.

Elon's jet receives a private temporary aircraft identifier unconnected to its owner every month, because it is subscribed to this program: https://www.faa.gov/air_traffic/technology/equipadsb/privacy

This government program was specifically designed to hide the link between an aircraft identifier and the owner of the aircraft.

If the link between Elon Musk and the aircraft identifier he flies with was meant to be publicly available, why does this program exist in the first place?


> Flightaware (and FR24) censors (for a fee).

Are there any services you're aware of that don't censor?

next

Legal | privacy