start	end	text
10960	14640	Hello everyone, thank you for attending my virtual presentation.
14980	20800	So, I am Guy, I'm a master's student from EPFL and ETH Zurich in Switzerland,
20800	25020	and I've been working with Arma Suisse on privacy in general aviation,
25020	29800	and most particularly on the recent attempt from the FAA in the US.
30460	33520	First, why do we need privacy in general aviation?
33660	38360	In the recent years, a lot of articles underline privacy issues in general aviation.
38360	42720	For instance, it would be possible to predict a company merchant acquisition
42720	47700	by tracking a company aircraft, as demonstrated in the Bloomberg article.
48220	52320	It is also possible to track diplomats' trips to a foreign country,
52320	56520	which is of course not desirable, or to track the use of corporate checks.
57120	60520	Furthermore, I guess that pilots just don't want to be tracked when flying,
60520	64720	so that's why a privacy policy is needed in general aviation.
64720	70340	But before diving into the actual policy, I will quickly introduce aircraft communications.
70780	76080	Aircraft need to be identifiable at all times when flying for obvious security reasons.
76700	79880	So, first it can be identified by the tail number,
79880	83340	which is the unique registration by the national authority,
83340	88720	it's also called N number in the US, and this number can never be changed.
89460	93900	So, that is the number that is usually printed at the back of the aircraft or on the tail.
95040	100650	Aircraft can also be identified by their ICAO address, which is a 24-bit transponder ID,
101140	105700	that is assigned by the International Civil Aviation Organization.
106080	112000	And there is a direct translation between the tail number and the ICAO address in the US.
112000	117660	So, if you're interested, I wrote a converter that is available on my GitHub.
118900	124500	And aircraft can also be identified by their callsign, which is a unique flight identifier,
124500	127960	and it can be changed for each flight. And, for instance,
127960	132800	private aircraft often use their tail number as a callsign.
133540	138720	Aircraft use ADS-B, standing for Automatic Dependent Surveillance Broadcast,
138720	142680	to communicate with the ground station and with other aircraft.
142840	148380	ADS-B equipment is mandatory in many countries, such as the US, Australia, and European countries.
148380	153940	I will not explain in detail how ADS-B operates, but what we need to know is that,
153940	159760	aircraft broadcast twice-a-second information, such as their position, velocity, etc.
159940	165260	And these broadcasts are identified by the ICAO address and the callsign of the aircraft.
165380	170240	Anyone equipped with a cheap software-defined radio can receive these broadcasts
170240	173160	from a distance of 600 kilometers.
174180	179700	Crowdsource networks try to cover large areas with antenna and software-defined radios,
179700	186920	in order to get a global ADS-B coverage and make aircraft trajectories publicly available online.
187300	190960	Using a crowdsource network, it is trivial to track an aircraft using
190960	194160	only its ICAO address or its callsign.
194180	198020	Aircraft can change their callsign for each flight, but not their ICAO address,
198020	200520	so they are actually easy to track.
200920	207020	So, this situation is a serious issue for aircraft and passenger privacy.
207020	212760	Until recently, the only way aircraft operators could protect themselves from being tracked,
212760	218580	was to ask kindly crowdsource networks to make tracking unavailable for the aircraft.
218580	222200	But some crowdsource networks do not offer this service.
223020	227140	Concerning these issues, the FAA published the following statement.
227400	233180	FAA acknowledges the desire of some operators to limit the availability of real-time ADS-B
233180	237780	position and identification information for a specific aircraft.
237780	242440	To address privacy concerns, the FAA has initiated the Privacy ICAO Address Program
242920	245780	to improve the privacy of eligible aircraft.
246920	253260	So, this Privacy ICAO Address Program allows enrolled aircraft operators to periodically
253260	256700	change their ICAO address, acting as a pseudonym.
257240	260540	So, if the aircraft operator simultaneously changes
260540	266580	their ICAO address and the callsign of the aircraft, it makes the aircraft harder to track.
266680	272340	This program is unfortunately, at least for now, limited to aircraft registered in the US,
272340	276720	using a specific ADS-B system and a third-party callsign,
277420	281200	just for flights in the domestic US airspace.
281320	287120	Which means that if an aircraft wants to fly abroad, it has to use its permanently
287120	294040	assigned ICAO address and is automatically revealed to anyone that wishes to track it.
294520	299000	In the first phase of the program, the FAA will monitor the program,
299000	306580	and a new Privacy ICAO Address, or PIA, can be requested every 60 calendar days.
306580	311680	And in the second phase, the program will be transitioned to third-party callsign providers,
311680	321300	and the PIA change frequency will go down to 20 business days, or 28 calendar days, approximately.
321940	327480	To illustrate the privacy improvement, we show an aircraft identified by its ICAO address landing
327480	334020	at an airport. On ground, at the airport, the operator will request a new Privacy ICAO address
334620	339860	and program it into the aircraft transponder and change the aircraft callsign before its next
339860	347260	flight. So an adversary can observe that an aircraft with ICAO address A12345 arrived at the
347260	354960	airport, and that another aircraft with ICAO address is ABCDEF left the airport later on.
354960	361540	If the aircraft is the only one that stay at the airport for the given time frame, then identifying
361540	368760	that A12345 and ABCDEF is actually the same aircraft is trivial. But if multiple aircraft
368760	373620	enrolled in the PIA program are changing their ICAO address in the same airport during the same
373620	379500	time period, it is not possible to link accurately aircraft arriving at the airport with aircraft
379500	387500	leaving the airport. So the best attack is in fact to take a random guess. So in order to maximize
387500	393480	the privacy of aircraft using this scheme, we need to maximize the number of aircraft using a PIA
394100	400440	and using the same callsign provider changing their PIA simultaneously at the very same airport.
400440	406940	So that's a lot of conditions, a lot of parameters that can influence the privacy level, and we're
406940	415100	going to discuss that in details. So here is the bigger picture of the ideal system where all
415100	422000	aircraft change their identifier for each flight without any side channel information. So a global
422000	430040	adversary can observe the flights, but it is hard to link accurately a flight from a given aircraft.
430700	437220	You cannot distinguish aircraft when they are flying if they change their ICAO address and
437220	445240	callsign at each stop. So this results actually in an asynchronous free route mixed net
445240	448740	where all aircraft stay inside the mixed net forever.
450860	457200	In order to quantify privacy performance of such a system, we will look at its traceability index
457200	461900	which is defined as the expected ratio of successfully tracked aircraft over time.
461900	466440	Here is an example. Time is represented on the x-axis and traceability index
466440	474000	of the system is represented on the y-axis. And the traceability index of this example system
474000	478200	after 150 days is 50.3 percent.
479020	485300	From the beginning of the year, we observed the US airspace through the crowdsource network
485300	492300	OpenSky networks and detected that 16 aircraft are using a PIA address. Nine of them are using
492480	499060	a DCM callsign and seven of them are using a FFL callsign. Those are two distinct sets of aircraft.
499060	505220	We observed aircraft changing their IKO address to a PIA and some of them didn't even update
505220	511160	their callsign. So that's trivial to track them even if they wanted to enroll to this privacy
512020	519640	program. So we did not observe any PIA change although some operators have been using the PIA
519640	526880	for much more than 60 days. We observed that all IKO addresses that we suspected to be PIAs
527480	537420	are in the N number range from N41000 to N42. And that 1062 official FIA registration
537420	547640	looked like the one on the right. So that is reserved with no fee on the 10-03-2019
548160	555480	by the SBS program office. And I will now explain and attack on how to track aircraft
555480	562320	enrolled in the PIA program. So the first step is obviously to identify a target aircraft
562320	568360	enrolled in this program. Then we need to associate the privacy IKO address with an actual
568360	575340	aircraft registration. And finally we need to monitor every PIA change of this aircraft.
575760	580740	To detect an aircraft using a PIA we first look for flights using an IKO address
581560	588500	in this given range. So the hexadecimal range. And then we check in the FIA registry
589100	595400	if the associated N number is reserved with no fee by the SBN program office.
595400	600080	And if it is the case then we're almost sure that this aircraft is using a PIA.
601100	606320	After we identify the target aircraft we need to find its original registration.
606320	612420	To reach that goal we need to find the very first flight where the privacy IKO address PIA1
612420	619160	was used. So that is our target PIA. So in our example as the flight departs from Chicago
619660	624620	we need to find all aircraft that landed at the very same airport in Chicago before the departure
624620	630060	of the red flight. So these aircraft are the candidates and we need to eliminate all of them
630060	638000	but one. For instance after the departure of the red flight an aircraft which is also identified
638680	644560	by the address IKO1 is observed leaving Chicago. So this aircraft is eliminated.
645400	651520	Then the aircraft identified by the IKO address IKO2 is observed flying back to its origin. So
651520	657440	there is only one candidate left which is our target aircraft that changed its IKO address
657440	668480	from IKO3 to PIA1. So we detected the IKO address change. Once we know IKO3 we look for the
668480	674240	associated N number. So we do the translation and we look for the associated N number in the FIA
674240	680300	registry to find the actual aircraft registration containing all of the owner's details like the
680300	687960	address and everything. And so once we have the actual aircraft registration we only need to
687960	693460	monitor the PIA change which is essentially the same operation as described previously.
694220	699580	Note that if multiple aircraft are changing their PIA at the same airport during the same time
699580	706460	period we have to select one at random and the tracking may be inaccurate. But it is also possible
706460	711860	to observe flying patterns of the possible candidates to increase the probability to
711860	717580	select the correct aircraft according to its pattern after the change.
718440	724500	We built a simulator to help us predict how the PIA program would scale if significantly more
724500	729840	aircraft joined it. This simulator takes as parameter a number of aircraft, a number of
729840	737480	airports, the average aircraft flight frequency, the PIA change frequency and also the simulation
737480	744260	duration. So once the simulation starts an aircraft will be picked at random and will fly to
744400	750100	a random airport. And then another aircraft would be chosen at random flying to another airport
750750	759300	and so on. So as the trajectories are random the simulator is not totally realistic but it provides
759600	766460	a lower bound to the traceability index as a random flight maximizes the entropy of the system.
766540	773880	The simulator is available on github if you want to check it out. And we implemented the previously
773880	782090	described attack to show the performance when we make varied simulator parameters.
783320	788760	On this graph we see the traceability index curve for a set of 200 aircraft and 100 are
788760	795320	over a year where aircraft update their PIA respectively every 60 calendar days as is phase
795320	801980	one of the program so that's the green curve. 20 business days which is 28 calendar days so that's
801980	807800	the orange curve for phase two of the program and every 10 day in blue that is just to show
807800	813500	difference. So we see that after a year the traceability index of the 60 days frequency
814300	822140	update is at 30 percent whereas the score is the same score is reached after only 101 days
822140	831660	and 37 days for the 28 and 10 days PIA update frequency. So updating the aircraft PIA as
831660	837760	often as possible gets the best privacy for the system.
838400	845120	And now we make the aircraft fleet size vary while keeping the PIA update frequency to 28 days.
845120	852380	So a fleet is a set of aircraft using a PIA and the same cosine space so all of the aircraft
852380	858920	are using a DCM cosine or all of them are using a FFL cosine. So we go from a fleet of
859820	866820	50 aircraft in blue to a fleet of 500 aircraft in red and we see that the traceability index
866820	875300	after 150 days go from 87.9 percent for the 50 aircraft fleet down to only 1.5 percent for the
875300	881620	500 aircraft fleet. So these curves really show that maximizing the number of aircraft
881620	887460	for a fixed set of airports and minimizes the traceability index of the system which is what we
887460	896700	want. Some obvious improvement to the PIA program would be to add an international pole IC so that
896700	902320	aircraft do not need to use their permanently assigned ICAO address when flying abroad because
902320	912140	that reveals their position but also which PIA they used in the past and so it would be easier
912140	922780	to track all of their flight history until the moment they flew abroad. And it would be also good
922780	931880	to make all ADSP equipped aircraft eligible to enroll in this program in order to maximize the
931880	939500	the number of aircraft. And all aircraft using a PIA should use the same cosine range which is not
939500	946420	the case currently as you can use the program with a DCM and FFL cosine so that makes two
946420	955900	distinct sets of aircraft and one for each cosine providers. As the privacy is maximized when
955900	961200	aircraft change their PIA as often as possible, a major improvement to the program would be to allow
961200	967980	aircraft to update their PIA for each flight. This gives us the best theoretical privacy performance
967980	975300	without modifying aircraft trajectories. But it comes at a price so it introduces extra work for
975300	981440	the administration that has to keep track of all PIA changes and it takes extra effort for aircraft
981440	990060	operator to program the new PIA before each flight. So on this graph we can see the traceability index
990060	998140	reached by a PIA change for each flight in green compared to the traceability index of the program
998140	1004660	in phase one and two in orange and blue. And we can see that the so the current PIA program is still
1004660	1014140	very far from the best possible performance. Another major possible improvement is to make
1014140	1020040	all aircraft change their PIA simultaneously. This method would consist in making all aircraft owner
1020040	1026880	update their PIA on or before the first flight after a given day. This would help maximizing
1026880	1032620	the number of aircraft updating their PIA during the same time period at the same airport as they
1032620	1038440	all update their PIA at the same time. This strategy would cause no extra cost for the
1038440	1045300	administration as there would be the exact same number of changes and could even be adopted without
1045300	1051980	any official changes in the program if for instance a group of aircraft operators agree on the dates
1051980	1058780	at which they will update their PIA. The drawback of this method is that privacy performance is still
1058780	1065140	far from the theoretical maximum but it's still better than in the regular PIA policy.
1065780	1072420	So this graph represents the traceability index curve of the 28 days update policy with the PIA
1072420	1078740	update uniformly distributed in blue. 28 days policy where all aircraft update their PIA
1078740	1084880	simultaneously in orange and in green the best theoretical performance where their aircraft
1084880	1091220	change their PIA for each flight. So we observe a major improvement for the simulation update policy
1092000	1098940	compared with the uniformly distributed one. For instance after 150 days the traceability index
1098940	1107140	goes from 56.9 percent in the regular PIA down to 31.3 in the enhanced version.
1107600	1113180	To conclude this presentation we showed that the PIA program makes it slightly harder to track
1113180	1118600	aircraft using ADS-B data from crowdsourced networks. It just makes it more annoying to
1118600	1124460	retrace from a privacy IKO address back to the aircraft owner but it's still possible so in a
1124460	1130340	sense the PIA program does not really meet its privacy goal. We show with the simulator that
1130340	1135680	even with a much larger number of aircraft using a PIA we can still track a large proportion of
1135680	1141900	them over time even if they update their PIA as often as possible. And we propose two concrete
1141900	1147940	solutions to improve the privacy in the PIA program. So if you want more details about our
1147940	1154920	work please make sure to check out our paper when it's out. And finally my take-home message is if
1154920	1160380	you get to use this program please make sure to update your privacy IKO address as often as possible
1160380	1164240	to increase your privacy level and others privacy level.