What prevents someone from hijacking a radio frequency mid-air?

Question

For someone who wants to stay anonymous and probably terrorize the skies, what protective measures do we have?

Without even thinking too deep, I can imaging the following scenarios for someone who's in a mood to mess around.

1. Flying in a busy airspace, calling to "Cancel IFR" for someone else.
2. Abusing recklessly. Maybe stepping-on the frequencies infinitely.
3. Reporting fake traffic or fake weather conditions, causing re-routes and delays.

While transponders are required in and around busy airspace, someone who really sets their target on screwing it up can REALLY cause a lot of harm, potentially fatal by flying without one for quite some time as a primary target on ATC's radar.

What are the current preparations to stop this from happening?

Answer 1

This sounds like a “people problem”. That kind of problems is best solved with enforcement.

Source of radio broadcast can be localized and it is not particularly difficult. There are techniques for transmitting something secretly, but they need specific modulation. Rogue broadcast or jamming on simple AM voice channel will be trivial to triangulate.

So if somebody did it, the FCC or FBI would pull out appropriate equipment, hunt them down and throw them in jail. Broadcasting without license, or contrary to the license you have, is in itself a crime and they'd throw in charges for endangering, which are quite serious.

Now of course it would take some time to hunt the perpetrator down. However, the situation is not that dangerous. Basically it could be treated as communication failure. VFR flights would continue flying visually, IFR ones would follow last clearance and then as filed, landings can be cleared with a light gun. And then either the surrounding sectors would be OK, or the pilots would probably try to establish some alternate communication. Cell phones should work fine for small aircraft while airliners would probably use HF or Sat links to dispatch and ask the dispatcher to relay.

Answer 2

I think it is a vulnerability, yes. But it has worked so far, much like the "if hijacked, cooperate with hijackers and let things sort themselves out" doctrine that saved many lives until someone figured out how to game the rule (and cost as many lives as were ever saved).

Indeed, right now, we depend on these being rare cases, that can be dealt with in the methods used so far, which are surprisingly ham-handed: sending FCC radio trucks, civil air patrol or ham operators on transmitter hunts. It could be a great deal more difficult if you had concerted efforts by quasi-state actors acting on a large scale - not one rogue transmitter but 20 in each of 10 regions, and the transmitters are moving. Imagine an actor learned to perfectly mimic Kennedy Steve, and sat there on channel giving wrong instructions, or heterodyning key instructions.

And of course, if a quasi-state actor is involved, this could itself be part of a much larger scheme, such as simultaneously, 4 planes code hijackings while 19 cargo planes turn off their squawks entirely, all this to turn military eyes toward missing planes and away from their normal posts... So then somethiing else happens. This is what you can expect modern war to look like in a highly technological and networked society.

For all the technology, human workload is still the limiting factor - so such nuisance attacks would be all about creating excess workload and distraction for the guardians to put them off their normal game, so you can slip something through that would be otherwise impossible.

A huge amount of this kind of cyber-war is who is making workload for whom. You want the hackers to be the frustrated and overworked ones.

A solution for radio

Speaking of heterodyning, I was blown out of my seat by the Midway Southwest-Delta incident, where similar flight numbers acted on each others' instructions and -just like Tenerife- heterodyned over each other. Seriously? Still?? SMH...

I've been carrying Hedy Lamarr's frequency-hopping tech in my pocket since 1997 (CDMA). This allows a bunch - a whole bunch - of phones to share the same frequency block without stepping on each other, and it works. Obviously, this also authenticates the transmitter, since voice wasn't free in 1997.

And duplex radio is nothing new, that's where you receive on frequency R but transmit on frequency T, and the repeater transmits on R anything it hears on T. Combine them and it becomes a simple matter: the control tower transmits on one frequency, and planes use CDMA to talk to the tower. Every plane has a separate virtual channel, with encryption used for identification. When two planes talk at once, they both get through. Assuming the control tower configures it as a repeater so you hear all traffic, you hear both KLM and Pan Am. Even slicker, there are several possible ways to mute your own transmission, so KLM doesn't hear itself, they only hear Pan Am - and vice versa. This would be the everyday advantage.

During an attack, ATC can mute "that guy" or can mute all traffic except identified traffic, and ask unidentified traffic to ident in some alternate way, like "please touchtone 5 7 8", and keep changing the "CAPTCHA" as it were.

Stepping on CDMA is hard, because all radios are stepping on each other all the time normally. So it would be hard to block the tower's transmissions outward, or planes' inward.

Answer 3

The reality is that there are stuck mics daily on ATC frequencies. Pilots and controllers utilize guidance from the AIM and sometimes creative improvisation. There have been numerous cases of lone actors wreaking havoc with ATC in various countries and they are usually located with direction-finding and dealt with by police.

There is no strong countermeasure. Company planes and carriers normally have alternative com equipment which has been used. Normally cellphones are impractical.

So a swarm of illicit VHF AM transmitters could wreak havoc but the peril is rather inconsequential.

Answer 4

Just the rules and physics.

1. If I was flying and I heard over the radio something like "Flight 122, Jacksonville Center, Request cancel IFR" I could just respond with "Flight 122, Jacksonville Center, That was not a legitimate request, we wish to maintain IFR" and though my phraseology is wrong, I could reasonably assume they got the messages. I would continue my clearances and flight plan till it got worked out. It would not take long to work out. It wouldn't take long. This is likely to have little impact. Mor importantly large, commercial aircraft are very unlikely to just cancel IFR out of no where.
2. This one would be easy to see. The antenna for omni-directional broadcast for a long range is quite large, and to have an impact you would need to broadcast your gibberish on a very large number of frequencies. Those two things together would certainly make your stand out in your neighborhood. The antenna may not look big at the airport, but it will in your back yard. Most likely you won't even finish getting it build before someone comes to take a look. If you do, then you will be found very quickly. Broadcasting a signal gives law enforcement a beacon to home in on. Don't forget ADF did just that for many years.
3. Fake weather would be pretty hard. Re routing and such may also not have that large an impact. Lets not forget you have to convince the pilots that your actually giving them a valid route. Depending on who your impersonating, that could be interesting. For example, at KMIA there are SIDs/STARs, you could give out the wrong ones of thous, except, at such a busy airport everyone already knows their SID/STAR before they even take off. In fact, even at smaller airports, SIDs are tied to destination directions and STARs are tied to arrival vectors. Try giving a south bound STAR to a northbound plane, and the pilot won't likely be able to comply, and will ask for clarification. Messing up spacing or timing might be a bit easier, but see point 2. You pain a giant bulls eye on your back, your not going to last long.

Bonus - Comms failures are not unheard of, there are other ways to communicate with ATC if you need to. Most of a flight, even an IFR flight, you don't really talk to ATC much. You gain clearances and switch "areas" (generic) but other then that, it's pretty quiet. It only really gets loud around airports or busy "areas". And with both sides of the conversation being able to hear anything said, both sides can go "nope wasn't me". And when in doubt the pilot just pilots. If it''s so bad that ATC goes dark or the pilot can't possibly make out what's going on. They just fly their last route/clearances/flight plan. Your going to have a very hard time getting a pilot, even a new one, to make a course change that puts his plane at risk. Avaite, Navigate, Communicate. That communicate one is last for a reason.