start	end	text
0	7420	Let me share my screen here and I'm going to start to go again.
11660	14460	Just in case, I'm going to share the whole screen.
14800	16960	I never know where I'm going to end up.
24700	26120	Let me go there.
32610	35390	And that's showing here again. Oh, well, of course it is.
35390	38850	Okay. So, first of all, welcome to this session.
39070	43630	I'd like to talk about Global Navigation Satellite Systems
43630	45930	and Automatic ID Systems Spoofing.
46610	49970	A lot of this has been in the news, certainly for a couple of years.
49970	51770	I mean, none of this that I'm going to talk about...
51770	53850	well, most of it is not brand new.
53850	56290	But I want to talk a little bit about GPS spoofing
56290	59890	and then evolve that into AIS spoofing as well.
60250	67130	So, on an integrated nav system on a boat,
67130	71970	and I've been fortunate enough to be able to walk through some really big boats,
71970	75030	although I spend most of my time on pretty small boats.
75870	79250	The key issue that I want to say,
79250	81670	and this is not going to come as a surprise to any of you,
81670	89290	is that GPS plays a big role in situational awareness for a boat.
89750	93630	On their chart display, on their chart radar,
93630	97210	them just knowing where they are relative to other things.
97210	100410	Of course, AIS is huge in understanding,
100410	102710	not only just seeing that there's a target out there,
102710	104470	but knowing something about the target,
104470	108310	which is information that radar, of course, won't give you, can't give you.
108730	113550	And then AIS itself, of course, and everything in the integrated nav system,
113550	118230	pulling together all of your chart downloads, your chart updates,
118230	120130	by the way, these are hacking vectors,
120130	124750	all of the sensors on a boat so that you can be producing your own messages,
124750	126370	giving situational awareness.
126370	131550	Anyway, the whole point is that GPS and AIS are highly intertwingled.
132350	138630	Now, again, I'm going to assume that most of you are familiar with at least part of this,
138630	145070	but just in case, there are four major global navigation satellite systems.
145070	149750	There's BeiDou in China, Galileo is the European Union, GLONASS in Russia,
149750	151870	and, of course, our GPS.
151870	153610	There are a couple of regional systems.
153610	157450	India has something called NAVIC. Japan has something called QZSS.
157990	163450	All of these systems use medium Earth orbit satellites,
163450	168430	and they're all using different constellations.
168810	174250	And, you know, as this chart is trying to show, or at least give you an idea,
174250	180890	you can see that the four GNSS satellites are at different altitudes,
180890	186230	you know, from the Earth, and then, of course, their orbital circumference as well.
186510	194510	The periods range for the different satellite networks from, you know, 11 to 14 hours for one cycle.
194510	198310	But one of the keys is also, look how far away they are.
198310	201250	I mean, you're talking 12 to 15,000 miles.
201370	206230	Now, the only comment I want to make about that is sort of obvious, but I'll make it later,
206230	214370	is the signal strength that is coming from a satellite 15,000 miles away is not terribly strong once it gets to the Earth.
214370	218090	That will be an important part when we think about jamming.
219330	227230	So when we talk about GNSS systems, we always talk about the space segment, control segment, and the user segment.
227310	230590	The space segment is, of course, the satellites themselves.
230590	233250	The user segment is the user equipment.
233250	241510	So here we've got, you know, this happens to be a GPS antenna, but any GNSS system would work.
241670	246190	So I've got a GNSS antenna connected to my GNSS receiver and display.
246190	252790	The GNSS information might be now connected to other devices in that integrated nav system, and we'll talk about that.
253730	256030	And then we've got the control segment.
256050	262250	And the control segment, of course, this is stuff that we as users don't really have much to do with.
262250	264830	But here's where you have the master control stations.
264830	269710	You have a variety of ground antennas, a whole bunch of monitoring and tracking stations.
269710	277790	But this is what is managed by, well, currently, if it's GPS, is managed by U.S. Space Force.
280400	285240	So what this slide is talking about is this.
285960	295120	And most of you, if you've played around with GPS, and particularly with any GPS app that tells you how many satellites you're seeing and all those kind of things,
295120	303060	the GPS constellation, for example, requires, I believe, 24 satellites to be operational.
303220	308880	We have 30. The extra six are basically backup in case one of the other ones fails.
309220	313100	For you to get a fix, you need to be able to see at least four of them.
315140	319800	So global nav systems all work by using trilateral rating.
319820	327700	So I have my receiver, and I can figure out how far am I from three of the satellites.
327880	335680	And if I can figure out how far and at what angle I am from the three satellites, I can, you know, trilateral rate.
335680	340260	That's probably not really a word. I can triangulate my position based on that.
340260	343060	So it's basically passive range funding.
343060	346340	And so here's the next point that I just made earlier.
346380	349640	These signals are being sent down at 50 watts.
349640	353700	They are minuscule, hardly measurable when they hit the earth.
354240	360080	This is why GPS jamming is very simple to accomplish.
360200	363000	All I need is a signal on the right frequency.
363000	367020	It's even a few watts, and I can blast out the GPS signal.
367020	372460	It's also trivial to detect when GPS jamming is being used.
372460	377000	So if you want to do surreptitious GPS jamming, you have a slightly harder problem.
377520	380720	And, well, that's not why I'm here.
380720	389160	But in any case, GPS transmits in the ultra high frequency band.
389420	394780	GPS in particular, and actually GLONASS as well, use the L band.
395440	400140	And all of the satellites are sharing the same frequency.
400240	403100	They're doing it with co-division multiple access.
403140	405980	We'll talk about CDMA in just a second.
405980	417180	And the way in which you can differentiate the different satellite transmissions is because each satellite is assigned what's called a pseudorandom noise sequence.
417180	421780	It's just a pseudorandom set of zeros and ones.
421780	426420	Each satellite has its own PRN code.
426420	429040	We know what the PRN codes are.
429040	435740	So when you're receiving a signal, you can detect the PRN code and you know what satellite is communicating to you.
435880	441680	Now, as a side note of history, I would like to point out that CDMA actually is an old idea.
441740	448480	It was invented in the early 1940s by a musician named George Antheil and the actress Hedy Lamarr.
448480	453220	Hedy Lamarr was responsible for a bunch of interesting inventions.
453700	465060	But they developed this for the Navy because you may or may not know if you read some early World War II history, US Navy torpedoes mostly missed their target.
465120	468560	And even a large number of them that hit the target didn't explode.
469020	471840	In any case, they offered this up for free to the Navy.
471840	476040	The Navy did not take them up on it for a couple of decades.
476040	481300	But in any case, today we see CDMA used in Bluetooth, mobile phones, and GPS.
483000	487800	Anyway, I said before that for us to get a position, we need four satellites.
487800	496060	So one of the problems with global nav systems is that all of the satellites have on board a cesium clock.
496060	498680	Your GPS receiver does not.
498680	500800	So there is some clock bias.
500800	508360	So if you want to trilaterate with just three satellites, which is really all you need, you're going to have an error of about a mile.
508620	521020	By reducing or eliminating the clock bias, which is why you need the fourth satellite to be able to correct that drift, you can get your error down to about three feet.
521480	527320	Which is why we get some very, very precise measurements with GPS.
528780	533500	So I mentioned GPS was now managed by U.S. Space Force.
533500	537440	It started as a Navy and Air Force project in the late 60s.
537440	542740	It was managed by the Air Force until the U.S. Space Force took it over, I believe, last year.
543360	546260	The first satellite wasn't launched until 78.
546260	551700	We didn't have operational GPS in the civilian community until sometime in the 90s.
553500	557580	And originally, civilian GPS was degraded.
557580	565860	And it was degraded in accuracy compared to military because what they would do is they would introduce timing errors.
566560	571020	So remember back here, I said, if you don't correct your timing bias, you can have some big errors.
571020	572620	Well, that's exactly what they did.
572620	586320	In 2000, which still would have been the Clinton administration, there was an executive order that basically said this so-called selective availability is no longer going to be in civilian GPS.
586380	590460	And even though the military wanted it, the president said no.
590740	594640	But there are basically today still two services.
594640	599340	There's the standard positioning service and there's precise positioning service for military.
599340	600960	GPS is for civilians.
602160	611360	We still have pretty good granularity, but selective availability could make the SPS service degrade.
611360	620160	But since we have no selective availability anymore, the SPS and PPS pretty much are equal in terms of service.
620300	626960	The difference between the two today is that PPS is encrypted and SPS is not.
626960	629220	So we'll come back to that later on.
629220	632580	Anyway, I already mentioned with GPS, we've got 31 satellites.
632580	634940	We need 24 at 95% uptime.
634940	639260	And each of the satellites has an orbital period of like 11 hours and 59 minutes.
639260	641640	So we get about two orbits per day.
643320	649360	Now, a GPS transmission, and this I'm really just giving you for a little bit of interest.
649920	654860	A GPS satellite is transmitting what's called a navigation message.
654860	659820	A navigation message has, as it says here, 37 and a half thousand bits.
659820	662340	We're transmitting at 50 bits per second.
662380	667780	It takes about 12 and a half minutes for the entire message to hit the ground receiver.
668060	674920	Now, in the message, we have the date and time, GPS date and time.
674920	684180	We have information about this particular transmitting satellite, namely its status and health and all that kind of stuff, as well as what's called ephemeral information.
684180	691240	So the position and velocity of the satellite, because if I'm going to measure my distance from me to the satellite,
691240	695560	I need to know exactly where the satellite is, oh, by the way, and how fast it's moving,
695560	699660	because that's going to impact how quickly I'm seeing the signal.
699660	701460	A little error, but it's in there.
702120	704460	And then there's something called the almanac.
704460	710720	The almanac has gross ephemeris data for all of the GPS satellites.
710920	713540	Now, the usefulness for that is this.
713540	720360	When you flip on your GPS receiver, it takes a couple seconds to figure out where you are.
720360	727820	Well, that's because it took a couple seconds to find and interpret the data from the first satellite.
727920	735300	But as it sees the almanac, it can figure out where all the other, at least visible, satellites are going to be.
735300	742460	And it's getting enough information from enough satellites that it can quickly find other satellites to ping off of.
742460	753100	This is also why sometimes you'll get a satellite, a fix that'll show you someplace, and a couple seconds later, all of a sudden, it changes.
753260	759240	Because, again, you were sort of getting a gross idea of where you were, but there may have been some error.
759240	764540	And then as it, you know, gets all of the communication, all the satellites, it gets in a slightly better position.
765780	770000	Just for FYI, GLONASS does a similar thing.
770000	774380	Their messages are only 7,500 bits, also at 50 bits per second.
774380	777520	They carry pretty much the same kind of information.
777920	782100	The data for the sending satellite is, you know, very specific.
782100	785320	And then it has what it calls non-immediate data.
785320	787680	Basically, that's the almanac for everything else.
789580	791520	I've already mentioned the L band.
792420	796420	So you're a techie group, so I'll say a couple of techie things to you.
797260	804540	If I am a satellite that's transmitting, I'm going to be transmitting on whatever carrier frequency I have.
804540	811600	So the L1 band, I actually didn't include the frequencies, I'm not sure why, but the L1 band is whatever frequency it is.
811600	824720	So what I'm going to do is I'm going to modulate my transmission on that carrier frequency by combining the nav message and exclusively ORing it with my PRN code.
824720	837040	Now, since the PRN code is unique to a satellite, I can extract the PRN code because the format for the nav message, I know that.
837040	842020	So now it's merely a matter of, like I said, I can extract the PRN information.
842480	845860	Now, I already mentioned before that there were the two services.
845860	853480	There was the standard service, unencrypted for civilians, and the precision service for military that was encrypted.
853480	858240	Well, one satellite is sending both signals at the same time.
858240	868180	And what they do is they send the precise position service, the encrypted military service, 90 degrees out of phase with the civilian service.
868180	871720	So again, all of that is happening on the same channel.
872700	878220	And there are some additional things you need for the PPS, this precision code that I mentioned here.
878360	882840	It just provides some better interference protection and spoofing resistance.
882840	888820	I mean, it's very, very hard to spoof on military GPS because you have to spoof an encrypted message.
888820	891240	And that is unlikely that you're going to do that.
891340	893440	Anyway, there's also the L2 band.
893440	897760	It was originally designed for military use only and encrypted applications.
898040	901900	It's now being opened up for civilian use.
901900	908660	They're also starting to use an L5 band, which is now going to be a third channel for civilian use on GPS.
911230	914430	I don't think I need to tell you why GPS is important.
915050	918610	Obviously, we need it for ships, all sorts of things on ships.
918610	920450	We need it for aids navigation.
920650	922130	We need it for ports.
922130	924230	We need it for vessel traffic management.
925350	930230	So, like I said, I'm not going to beat you up too much on the importance of GPS.
931850	938690	I will observe, however, that when we talk about GPS spoofing, GPS jamming and all that kind of stuff,
938690	946750	one of the things that doesn't get talked about, in my view, enough is the importance of GPS to timing.
947050	952410	There are a lot of devices on Earth that get their timing from GPS satellites.
952950	960110	For example, all digital telecommunications networks, including North American mobile phones and digital telecom carriers,
960110	962730	are basically working off of the same clock.
962850	965470	Power grids need timing.
965470	968470	Some of the network time protocol servers on the Internet...
969090	976290	Anyway, the point is that if I can disrupt timing signals coming from GPS,
976290	982130	then that also is another attack vector on the entire GNSS system.
982130	990150	Even though I might be getting what I believe are accurate records of where I am, I can still be screwing up the timing.
990330	993950	The second bullet item actually has a lot here.
993950	999470	A one nanosecond timing error can cause a one foot positioning error.
999930	1007870	Now, as a mere aside to this, many of you may know who Grace Murray Hopper was.
1009130	1015070	Grace Murray Hopper, when she was still on active duty as an admiral in the late 1970s,
1015070	1019870	I had the joy to see one of her talks. I got to drive her around Vermont for a day. That was really cool.
1019870	1025450	She would always go to her lectures and say, you know, back in the day...
1025450	1032550	Well, she didn't use that expression, but back in the 50s, programmers were always trying to save nanoseconds.
1032550	1037290	One day I went to one of the engineers and I said, what is a nanosecond?
1037630	1041010	And he looked at me, then he pulled out a piece of wire.
1041010	1048610	He cut off 11.8 inches and handed me the wire and says, that's how far light travels in a nanosecond.
1048610	1052970	So she would go to all of her lectures carrying around a whole crapload of nanoseconds.
1052970	1055150	And she'd hand out, you know, pieces of wire to people.
1055310	1059390	In any case, I remember that lecture from, you know, 40 years ago.
1059650	1066170	I think it was only 40 years ago. In any case, but that tells a lot.
1066170	1068590	A nanosecond puts me off by a foot.
1068710	1075530	If I can cause there to be, you know, a hundred nanosecond error or a microsecond error,
1075530	1079210	we can cause people to be, you know, way far off from where they want to be.
1079630	1083390	In any case, GPS jamming has been around for a while.
1083490	1089070	We started to hear about this publicly, really, probably about four or five years ago.
1089070	1096650	There was one really famous case where, well, the Newark airport was testing its automatic landing system.
1096750	1103950	They had a plane coming in on automatic landing and they lost their GPS signal.
1103950	1111950	So it happened because there was a truck driver who was taking a break, didn't want his bosses to know where he was.
1111950	1116410	So he bought a GPS jammer so that his truck wouldn't broadcast the GPS signal.
1116650	1122170	Anyway, they eventually found him. But the fact is, GPS jamming is relatively easy to do.
1122170	1126910	It is totally illegal, but you can still buy GPS jammers.
1129430	1137110	And in any case, the advice from the Coast Guard, you know, the trust, but verify if you don't have your GPS data,
1137110	1140670	know how to read your chart, use your binoculars, all that kind of stuff.
1141410	1145150	But really what I want to talk about is GPS spoofing.
1145590	1152790	The first real public story about GPS spoofing came out also about six years ago.
1153310	1162050	A group from the University of Texas at Austin spoofed the GPS signals on a yacht called the White Rose of Drox in the Mediterranean Sea.
1162810	1165750	And I'm going to show you a one and a half minute video.
1165750	1172790	But basically what happened was using totally COTS equipment, they built themselves a GPS transmitter.
1172790	1177510	They put the attacker on the boat. The boat crew knew that something was going to happen.
1177510	1190810	They just didn't know what. And the attacker slowly started sending increasingly powerful GPS signals until it overwhelmed the boat's GPS receiver.
1190810	1200050	And then they drove the boat off course. And then the crew dutifully put the boat back on course, which of course drove it off course.
1200050	1205050	So with that teaser, let me give you a one minute and 37 second video.
1205050	1208510	I'll try to make my volume loud enough so that you can hear it.
1216680	1228400	Southern coast of Italy in June 2013, a 65 meter super yacht and her crew were part of an unprecedented experiment led by the University of Texas at Austin
1228400	1235700	that successfully coerced the vessel off course using a custom made GPS spoofing device.
1235700	1245440	30 miles from land, the crew's sense of the ship's location is based entirely on simple GPS signals broadcast from orbiting satellites.
1245700	1254500	The student, serving as the attacker, commands the spoofing device to transmit faint, counterfeit signals towards the ship's antennas.
1254500	1263320	The attacker increases the power of the spoofing signals until they are stronger than the satellite signals, gaining control of the ship's navigation system.
1263320	1267160	The takeover is stealthy. No alarms are triggered.
1267180	1272700	Once in control, the attacker initiates a three degree change to the ship's course.
1272700	1277660	The ship's navigation system reports that the vessel is drifting slowly to the left.
1277660	1281860	The false location is represented here by the ghost ship.
1281860	1287160	The crew applies a course correction to bring the ghost ship back onto the intended path.
1287160	1290600	In reality, the ship is now on the attacker's course.
1297500	1299380	So, pretty cool, huh?
1300360	1305860	So, armed with that, I'm going to show you some other case studies.
1306560	1315660	I'm not going to tell you every case study that I know about, but what I'm trying to do is show you the escalation in GPS spoofing that's occurred over the years.
1315860	1323000	So, in the University of Texas case, what they did is they spoofed one vessel to go off course.
1324260	1329020	In 2017, there was a mass GPS spoofing event in the Black Sea.
1329420	1333400	And what happened was, this was reported by the master of a vessel called the Atria.
1334680	1339600	And Atria was parked off the coast of Russia.
1339840	1347020	And all of a sudden, his GPS and AIS told him that he was in the middle of an airport.
1348420	1365300	And, oh, by the way, his closest point of alarm notification on his AIS devices were going crazy, because he was now also being told by his AIS equipment that you're less than 100 meters from 19 other ships.
1365680	1373140	Now, the captain's no fool. He goes out to his bridge, looks around, and says, yeah, I'm in the water, and there's no other ships in sight.
1373140	1381000	But here is showing where he was. That's the ship's position on the bottom.
1381120	1389780	And up above is showing the GPS coordinates of where, well, his GPS device was telling him where he was, again, in the middle of an airport.
1389900	1400340	Now, one of the interesting things that's worth noting on this is on this GPS display, over on the right, you can see it's identifying all these satellites.
1400340	1412100	And they're all coming in with the same power, which is unusual, because you've got six GPS satellites. They're not all the same distance from you. All the power shouldn't be the same.
1412780	1425300	In any case, in 2018, we start to get a report, constant GPS issues in the eastern Med and some in the Red Sea.
1425300	1438440	This continues into 2019. Throughout the Med, people are finding GPS issues. GPS is going out. Ships are finding themselves being told they're in entirely different locations.
1438900	1448380	And so last year, about a year and a quarter ago, a place called the Center for Advanced Defense Studies put out a report called Above Us Only Stars.
1448380	1458860	It is really, really an interesting report. And it basically talks about how Russia has been manipulating GNSS signals for at least the last four years.
1458980	1471800	And they show a bunch of examples of vessels thinking that they're docked in the water and yet actually being, or the GPS telling them that they're at an airport.
1472500	1486660	Usually it's a nearby airport. And it's been a real interesting, it's a very, very interesting read, because particularly now, if you read some of the more current literature, they're talking about, well, it's not just Russia.
1486660	1494040	China is doing the same thing. North Korea is doing the same thing. And, you know, obviously, spoofing is a problem.
1494820	1511700	Four years ago, spoofing was something that a nation state could pull off. Increasingly, GNSS spoofing technology is becoming such that a terrorist group can use this, criminal gangs can use this, loan operators can use this.
1511760	1516920	So, I mean, this is a big issue right now for, you know, well, all the obvious reasons.
1517700	1524020	So one case study that's worth mentioning, some of you may know about this, this was about a year ago.
1524540	1530740	The tanker Stena Impero, it's a British ship, was seized by the Iranians.
1530740	1543040	Now, the suspicion was that the Iranians seized Stena Impero because the Brits had seized an Iranian vessel in Gibraltar for violating some of the European Union sanctions.
1543040	1549940	But in any case, when they went back and they looked at the AIS data, they saw, well, here was the path of Stena Impero.
1550040	1554380	And it's gone through the Strait of Hormuz, staying right down the middle where ships are supposed to stay.
1554380	1562240	And then all of a sudden it turns north and starts to go into Iranian waters where it was seized for violating their waters.
1562920	1572420	And there has been a lot of, a lot of talk and a lot of ink spread about the fact that they believe that this was a GPS spoof.
1572420	1575100	That caused the ship to go off course.
1576080	1583260	But more interestingly is what happened, or at least started to be reported, last year in the port of Shanghai.
1583620	1592400	So all of the spoofing so far has been directed either at a single vessel or at a group of vessels, placing them all in the same place.
1592820	1600660	So what happened in the port of Shanghai, and it's really interesting to read this, we have this vessel, Manukai, and he's going up the river.
1601440	1610980	And he's checking his ectus, and the AIS is reporting that there's a ship at a berth that's in the channel, making seven knots.
1611020	1615780	Then all of a sudden it disappeared. And then all of a sudden it was back at the dock.
1615780	1620280	Then it was now underway at a variety of different speeds, then it disappeared.
1620280	1623240	And this pattern continued over and over.
1623240	1631980	Now again, the master of the vessel is no fool, goes out to the bridge, looks at his binoculars and says, yeah, that other vessel has never left the dock.
1633420	1640280	And so when some analysis was done of the spoofing events that had been going on in the port of Shanghai,
1640280	1649900	what they found was that multiple vessels had been spoofed simultaneously to be in multiple locations.
1649900	1656620	One vessel was in multiple locations, but all of the different ships were at different locations.
1656680	1660980	And that was actually really hard to pull off.
1661000	1667200	And then when they looked at the collection and intensity, they found that, as it says here, this crop circle,
1667200	1677000	they found that the most reported spoofed location came out in these circles.
1677000	1684440	And it hasn't been just Shanghai. Earlier or late last year, we started to hear about circle spoofing in Iran.
1684440	1690960	This is Tehran, where some ships out at the harbor were all finding themselves downtown Tehran.
1691440	1705400	And in one of the most interesting things that was recently reported was a whole bunch of circle spoofing in the area of Point Reyes near San Francisco and up the west coast of California.
1705400	1709720	And you'll notice we have all these different circle spoofs here.
1709940	1721520	And what's really interesting about this is in all the previous circle spoofing that the boats having their GPS spoofed in Shanghai were at least in Shanghai.
1721760	1729760	The West Coast spoofing happened over a whole bunch of dates, but the ships were actually in a whole different hemisphere.
1729760	1736560	And yet their GPS was putting them off the coast of California, off the West Coast of Canada, up near Alaska.
1737300	1745640	Really, really interesting stuff. I say interesting in an intellectual way and an academic way.
1745640	1749320	It's actually horrifyingly bad if you're on that vessel.
1751360	1757720	Now, you can spoof GPS without actually having a GPS device.
1757720	1770420	So, again, Eric Raymond has a really cool site where, if you go to it, I'm going to try to get over there.
1771920	1783640	And this page called NMEA Revealed talks about, you know, all the different NMEA messages that you can associate with GPS.
1783640	1789280	So I'm going to leave that there for now. But in any case, the point is, you know, you can get to all these things.
1789340	1792180	At the bottom there, I have an example of a GPS message.
1793280	1798800	The GP says that the talker, the device that you're communicating with, is a GPS device.
1798960	1803260	The GLL is a particular type of message. This is the geographic position message.
1803300	1806940	And then you can see all the other information that's here.
1806940	1812500	I've got my latitude, 29 degrees, 11.585 minutes north.
1812500	1817860	Here's my longitude. Here's the UTC time when this fix was taken.
1817960	1822860	This thing here is a checksum. This message is a GPS fix.
1822860	1825760	It's slightly, just has slightly more information.
1825760	1831620	But the point is, it's pretty easy to download code that can generate these messages for you.
1831620	1840100	In fact, it's easy enough... hang on, I'm not sure what just broke there.
1843470	1846610	Okay, well, this appears to still be there.
1846810	1852070	I'll get back to... hopefully you're all still seeing the PowerPoint.
1852310	1856770	Anyway, you can create these messages relatively simply.
1857710	1862730	And then there's all sorts of ways you can use something like a software-defined radio
1862730	1868110	to poke this stuff out on the L1 frequency, which I happen to give you here.
1868430	1872950	And again, a ton of open source tools available to do this.
1873410	1879630	Now, there are a number of ways in which spoofing can be mitigated.
1879710	1883890	Because I don't want to leave you with the impression that, oh, GPS is going to hell now.
1884310	1888290	First of all, and this is starting to be built into a lot of receivers,
1888290	1895750	is you can detect the signal distortion at the instant when the bogus signal overpowers the legitimate message.
1895750	1901110	It turns out there are some blips if the spoofer doesn't do this right.
1901110	1909670	The other thing is, when you're getting GPS signals from X number of satellites, they're coming from X directions.
1909670	1912490	Most spoofing comes in from a single direction.
1912490	1919130	Even if it comes in from multiple directions, you can see that all of a sudden I have a new signal
1919130	1923430	and it's not coming from where I'm expecting it to have been coming from.
1923710	1929890	The other thing is, the spoofed signals won't have the encrypted military signal on it.
1929950	1935110	So one thing that people are starting to do is they're starting to correlate the encrypted signal
1935110	1939250	to be sure that it is an authentic encrypted signal.
1939250	1945570	Now, my receiver can't interpret the military signal, but at least I can tell if it's legit.
1946530	1954030	And then, of course, more and more GNSS receivers on the big boats are monitoring multiple constellations.
1954030	1959950	So if I think that GPS isn't working, I can switch over to, you know, GLONASS.
1959950	1964490	Now, it turns out there is a report that just came out that said that U-2 pilots currently
1965530	1970510	are reportedly using watches that have all four constellations.
1970810	1976670	And the Raymarine GA-150 unit I just mentioned, because I found it as an example,
1976670	1979470	has this built-in GPS GLONASS receiver.
1979470	1982370	So, you know, it's using both constellations.
1984270	1987150	Now, I really wanted to talk about AIS.
1987150	1992970	So that gets me here. But AIS doesn't work without GPS,
1992970	1998450	although there are ways that I can spoof AIS and I don't even have to worry about GPS.
1998850	2004230	So I've already mentioned AIS is, or we've already talked about.
2004230	2008130	Automatic ID system is a situational awareness system for ships.
2008330	2015630	It provides a way that ships can identify who they are, in some cases, what their cargo is,
2015630	2020530	what type of vessel they are, their position, speed, heading, destination, all that kind of stuff.
2020630	2025670	It also means that maritime authorities can track the vessels that are coming within their areas of responsibility.
2025790	2029010	Ports can track vessels coming into their port, etc., etc.
2030970	2036390	Now, there are rules about who is required to carry AIS.
2036630	2040390	And this page is trying to give you some idea of those.
2040390	2046490	You can get the idea that AIS is required on big vessels, which probably doesn't come as a surprise to anybody.
2046890	2051590	There is a warship exemption, which I'm not going to worry too much about.
2051870	2060170	But in any case, the point is big ships and or ships with a lot of passengers all need to be broadcasting their AIS information.
2061050	2066070	So here is just an example of an ECTIS display that you might see on a boat.
2066990	2072370	And, you know, again, you've got all your targets here, at least all the targets that are broadcasting.
2073330	2078670	And you can click on them and they're going to show you whatever information they're going to show you.
2080330	2084350	I use a program called OpenCPN.
2084870	2087190	If you were in my last talk, you saw that there.
2087190	2090910	I'm going to actually get rid of this right now because I don't care.
2090910	2096430	But right now I'm getting information off the area of Daytona Beach.
2096450	2098570	So, for example, right here I have a vessel.
2098570	2102250	Oh, the Ho Detroit. That is a new one for me.
2102450	2105910	Anyway, another ship from Norway.
2107730	2117570	And so right now I'm getting the fact that, OK, its destination is Jacksonville, which, of course, is north of us by about 90 miles from where they are.
2117810	2120070	Yeah, probably about 100 or so miles from where they are.
2121190	2125990	And their ETA is to get there tomorrow morning at 0700 UTC.
2126470	2128770	Here's their speed, their course, their heading.
2128770	2130230	They're going in a straight line.
2131610	2133510	And here's the size of the vessel.
2133510	2135810	So this is no small vessel.
2136730	2139110	Over here, I've got another vessel as well.
2139110	2140910	The Charles A. That one's new.
2141230	2142770	At least I haven't seen it recently.
2142970	2143870	You know, same kind of thing.
2143870	2147150	Here we have a tug and it's actually towing a stern.
2147150	2148290	We get that a lot.
2148290	2151450	We have sea-going barges up here.
2151450	2154790	So getting a tug, towing something, not unusual.
2155050	2156570	This one's going to New York.
2156770	2158510	Don't know where it came from.
2158530	2161710	And it says it's going to get there on June 19th.
2163590	2164230	Yeah, OK.
2164230	2172390	So all the information that you see on AIS may not be 100% accurate because I don't think they're going to take another year to get where they're going.
2172930	2175350	But in any case, you take what you can get.
2175350	2177990	Here we're actually seeing it report its rate of turn.
2178570	2183230	It's turning at least five degrees every 30 seconds to the port.
2184390	2187190	So this can be useful information as well.
2187830	2190170	In any case, I told you that.
2190310	2194250	So I can tell you some other stuff that I'm going to show you here.
2197430	2206920	So in any case, the AIS communication protocol largely uses something called self-organizing time division multiple access, which is a little bit of a mouthful.
2207310	2216630	But basically, you're broadcasting in what you consider to be your time slot and you make reservations for other time slots.
2216630	2221430	Every vessel that can hear you hears your time slot reservations.
2222850	2231610	Usually you're only talking to other vessels that are within about a 10 or 15 mile range.
2232610	2237910	I mentioned here on the page that there's a bunch of protocols from the National Maritime Electronics Association.
2238430	2241550	0183 is the most common one that we're going to see over the year.
2242350	2245770	This protocol has been around since about 1986.
2245870	2250130	NMEA 2000 has been around for about 20 years.
2250130	2252790	And the OneNet protocol is brand new.
2253510	2258170	And I thought I had some additional information on that, but I don't right here.
2258370	2266250	In any case, if you want to know more about AIS, you can also read these ITUR recommendations and you can download those online.
2268510	2278610	Now, the folks at Trend Micro, a team led by a fellow named Marco Balduzzi, actually has published stuff.
2278710	2283770	And he's spoken probably at DEF CONs or Black Hats about issues with AIS.
2283770	2287150	And he's been talking about this for, you know, seven years.
2287770	2294590	But there are four main vulnerabilities with the AIS protocol that are important that I want to address.
2294590	2297610	One of them is lack of message integrity.
2297690	2304810	And the lack of message integrity being that when you get a message, you don't actually know that that was the message that was sent by the other person.
2304930	2319910	So it is theoretically possible, although very difficult, and I would argue maybe even unnecessary, but it is theoretically possible that some ship will transmit a message and another vessel could overwrite a portion of the message.
2319910	2327270	But in any case, there's no way to prove that the message you receive is the message that was transmitted.
2327510	2329810	There's also no timing integrity.
2329870	2333830	So when you receive a message, you're receiving it obviously in real time.
2333830	2336450	You don't actually know when the message was sent.
2336830	2346970	There is no authentication, meaning that when you get a message purporting to come from a particular vessel, you have no way of knowing that it really came from that vessel.
2346970	2350670	And there's also no validity check.
2350670	2357810	Namely, if a vessel says, I am located at the following lat and long, there's no way to prove that they're really at the lat and long.
2358330	2364170	Now, if we compromise AIS communications, I can do all sorts of, you know, weird things.
2364170	2368550	I can create fake vessels that now other ships are going to respond to.
2368550	2380510	I can trigger false SOSs, search and rescue messages, collision alerts, closest point of approach alerts, bogus weather information that might cause you to deviate when you don't have to deviate.
2381090	2382930	Why would I want to do that?
2382930	2384390	Well, I'm a pirate.
2384470	2387070	I can only make it 30 miles offshore.
2387070	2388790	You're 50 miles offshore.
2388790	2394230	If I can somehow get you to deviate 20 miles closer to the coast, you're now within my range.
2394230	2396550	So reasons such as that.
2396550	2405690	So anyway, so when you get the presentation, you'll see I mentioned some, you know, I mentioned these again with a few more verbs.
2406050	2408850	But again, there's other things you can do.
2408850	2412470	By the way, you can create vessels that aren't real, ghost vessels.
2412770	2416490	You can also do something called a frequency hopping attack.
2416490	2429830	You can actually launch a denial of service attack on other vessels and basically either usurp all of the frequency or you can cause them to just transmit in areas where nobody else is listening.
2433140	2437100	This is also a picture that was a little bit inspired by the Balduzzi group.
2437100	2448860	Just showing all the different vessels and their communication of AIS messages and ways in which you can or attack vectors that are possible.
2448860	2452380	There are a lot of lines here in green.
2452460	2455180	The green are RF based threats.
2455180	2460160	So there's a lot of ways that if you can get yourself on the radio network, which is not hard to do.
2460160	2468260	You can send out bogus information that is going to impact vessel traffic management, vessels at sea.
2468260	2471940	And then, of course, there's other ways of doing it with just straight out software.
2473780	2490260	Now, AIS is used to transmit information, not only to the vessels in the local area, but there are a lot of services that gather this information, aggregate it and then post it online.
2490260	2504100	And so I just want to observe that the International Maritime Organization recognized 15 years ago that this information leakage potentially impacts safety at sea.
2504840	2507920	I think they were right 15 years ago.
2507920	2512180	I think today that that horse has left the barn.
2512300	2515300	So it's something that we need to deal with.
2515300	2518020	I don't think it's something that we can stop doing.
2518020	2522300	But as an example, this is MarineTraffic.com.
2522540	2526200	It's one of many aggregator sites.
2526200	2531520	And you can sort of get an idea right here of, you know, all these vessels that are floating around the world right now.
2531520	2541360	There's something on the order of 75,000 merchant cargo ships going around the world at any given point in time.
2541920	2545060	They're all required to be broadcasting with AIS.
2546440	2548260	This is the White Rose of Drax.
2548260	2554260	You may remember White Rose was the vessel that the University of Texas at Austin people used.
2554640	2557740	On the date where I actually did this, they were in Monaco.
2558520	2562040	Oh, by the way, there's a picture of the boat.
2564520	2565940	Here's Find Ship.
2566840	2573040	I took this screenshot, you know, about, well, a little over two, probably about two and a half years ago.
2573800	2575920	Atria happened to be in Barcelona.
2576620	2579700	You can do real-time tracking of vessels.
2579700	2583720	These are vessels that are off of Titusville and Port Canaveral.
2583900	2592280	And so not only am I getting the vessel and information about the vessel, but I can see the track of the vessel, where it had been coming from.
2592280	2593860	This is from Vessel Finder.
2594940	2599980	Now, I talked in my last talk, and so I'll merely just mention it again.
2599980	2603400	It's easy enough to build your own AIS receiver.
2603580	2606000	There's a variety of tools to help you do that.
2606000	2612160	I use the Raspberry Pi and Daisy Hat and bring in information that way.
2613540	2619480	And then what you can do is you can display this information using any number of open source software.
2619860	2621660	I happen to use OpenCPN.
2621660	2626380	It is probably one of the more commonly used, but there's other software that can display this as well.
2626380	2629400	But really where I want to go is this.
2629740	2633920	This is what an AIS message looks like.
2633920	2640420	This is a particular type of AIS message that is being transmitted from another vessel.
2640740	2645220	And I'm going to break this down just real quickly for you.
2645680	2655320	So the exclamation point at the beginning says this is an NMEA 0183 message that has special encapsulation.
2655320	2660380	The AI says this is an AIS message.
2661260	2666140	The VDN is a VHF data link message.
2666140	2671500	So this is a message coming in from an AIS device on another vessel.
2671500	2673080	It's not your message going out.
2673080	2675020	Somebody else is coming in.
2676210	2683640	So AIS messages are transmitted as a set of one or more sentences.
2683640	2690100	So what this is telling me is that there are two sentences comprising this message.
2690100	2692380	This is sentence number one.
2692380	2696080	And this sentence has serial number zero.
2696080	2699260	I need a serial number so that I can reassemble, right?
2699380	2702820	Then I have A telling me this is being broadcast on channel A.
2702820	2710960	And then the rest of this gobbledygook up until I get to the comma is the encapsulated AIS message.
2710960	2719380	The zero here tells me that I'm going to have to add no bits to get six bit alignment.
2719380	2721760	And then the 7B is the checksum.
2722200	2727860	The second line says, well, two sentences or two sentences in the message.
2727860	2732700	This is sentence number two of serial number zero on channel A.
2732700	2733880	Here's the message.
2733880	2735580	We need two padding bits.
2735580	2737500	Here's the checksum of the second message.
2737500	2739160	Anyway, this is a message type five.
2739160	2741740	It's called the ship static and voyage related data.
2741840	2744060	And here's the information that we get.
2744360	2745780	So here's the name of the ship.
2745780	2747000	Here's the type of cargo.
2747020	2748300	Here's the ship dimensions.
2748620	2751940	This is actually telling me where is your AIS antenna.
2753380	2760820	So this is how far from the bow, how far from the stern, how far from the port side, how far from the starboard side.
2760820	2762040	Anyway, there's all this information.
2762040	2764320	Oh, and by the way, where it's going and what it drops.
2766700	2770640	Here is some of the code that I've written, an AIS parser.
2770640	2776940	This is taking a different AIS message, but it's parsed it out same way and giving you a URL.
2776940	2781780	So when you click on the latitude and longitude, up comes a map and shows you where this thing is.
2783840	2787080	So I have a couple of tools that are on my website.
2789420	2791700	One is called timestamp data.
2791700	2793660	It's a Perl program.
2793660	2812400	And what timestamp data does is if you point timestamp data at a TCP or UDP socket, IP address and a port number, it will take AIS data from there and put a timestamp on it and collect it into a file.
2812400	2823800	You can then take that file and use a program called play AIS, also a Perl program, and it will take the AIS data and put it out to a TCP UDP socket.
2823900	2826980	So I'm telling you that so I can tell you this.
2826980	2828760	I'm not going to show you a video.
2829040	2831820	What I'm going to do is this.
2832160	2834660	And you guys will get to see this live.
2835420	2839140	So this is Daytona Beach, more or less.
2840100	2843560	Down here where this black boat is, it says Middle Island.
2843620	2846540	This is Ponce de Leon Inlet.
2847720	2849900	So we're on the east coast of the Atlantic.
2849900	2851760	And you see we got all these boats here.
2851820	2855520	I need to go around to my terminal window.
2858400	2861520	I need to get to the right window here.
2861520	2863820	That's timestamp. I don't want timestamp.
2865920	2868040	Okay, so we got play AIS here.
2868040	2872920	You would have thought that I would have set this up already, but I was playing around with it so much.
2872920	2878520	What I'm going to do is I'm going to run a program or run a file.
2879680	2882100	And actually, I'll let you see what the file says.
2882100	2889140	All this is doing is it's play AIS, and it is going to replay a whole bunch of data.
2890400	2894840	And if I show you what this data looks like...
2901290	2905430	I mean, all this is is a whole crapload of AIS data.
2905690	2911950	Now, really, what I want to do here is actually play this for you.
2913410	2913890	So...
2915710	2918610	Rats, I was right there, too. Here we are.
2918610	2922610	Okay, so we're actually going to run this program or run this shell script.
2924850	2928030	Now, I'm going to go back over here to OpenCPN.
2928070	2933730	And what's going to happen is right around here somewhere, watch closely, a vessel will appear.
2934210	2936370	It will be called the CFOX.
2938410	2940370	Yeah, live demos. Don't you love them?
2940370	2943490	Okay, so here is the CFOX.
2945030	2948090	And that's what the information we have on the CFOX.
2948430	2954210	Now, the CFOX is a real ship. So is this ship that also magically appeared, Jupiter.
2954430	2956150	They're also a real ship.
2956590	2960530	But the difference is... I'm going to go back here for a second.
2960810	2963870	See this data that's going out? Well, let's ignore that.
2964050	2967570	Let's just look back up here. You see the date of the data?
2967570	2974370	2019-7-23. Those vessels are real, but they were there a year ago.
2975150	2978670	So this is a classic replay attack.
2978670	2990630	If you're a vessel relying on your AIS, and all of a sudden you see a couple of ships appear that weren't there before, well, you're going to take certain action.
2990770	2993310	Here's a ship called the Voyager. It's a sailboat.
2993310	2999690	And to be honest with you, I don't remember whether that was there before, so I don't know if that's a real ship or a stupid ship.
2999950	3004890	Now, this is merely a demonstration of capability. I'm not actually transmitting this on the radio.
3004890	3007710	I'm transmitting this from one end of my computer to the other.
3007850	3016930	And one of the criticisms that I have sometimes gotten when I showed this demo is, well, you know, if you had radar, you would know that that's not a real ship.
3016930	3024430	And that may be true, but I've been on plenty of boats that don't have radar. They do have AIS.
3024470	3026290	But I'm going to show you this instead.
3026490	3028130	This is Ponce Inlet.
3028230	3032470	Now, for those of you who are mariners, you understand the reds and the greens and all that kind of stuff.
3032470	3037030	You also understand the difference between the dark blue and light blue.
3037030	3042230	And in this case, the dark blue is shallow water and the light blue is deep water.
3042330	3045470	So Ponce Inlet is dredged up here at the north side.
3045470	3049630	And you'll notice if you look at the buoys, it's very clear.
3049630	3053710	Here's your number two buoy, and they want you coming in on the north side.
3054170	3058570	So I have something else I want to show you.
3059370	3061350	And let's see.
3063030	3064430	Well, here we go.
3064430	3067950	Let me see if I can just remember the name without embarrassing myself.
3072480	3078640	So if we go back here, note we have a bunch of things just appearing.
3079200	3083460	These are virtual ATONs, virtual aids to navigation.
3083860	3092780	This first virtual ATON, which I have dutifully named PI for Ponce Inlet, is telling me that this is a preferred channel marker.
3092800	3100740	Not only is it a preferred channel marker, but it's telling me that the preferred channel keeps this marker on my starboard side.
3100740	3103600	Meaning I want to come in this way.
3103960	3112220	And now if you look at the triangles and the squares, it's telling me that my preferred channel brings me in right here, right into the shallow zone.
3112580	3123800	If I do a target query on this, I'm going to see that this has an appropriate ID that tells me that the Coast Guard put this out there.
3123800	3131660	Because the Coast Guard is the only authority in the United States that has... well, it's the only organization that has the authority to put out virtual ATONs.
3131660	3135040	But there's no authentication in AIS.
3135400	3139980	So my observation is here, all the radar in the world isn't going to help you now.
3140240	3151080	Because if you don't know this inlet, you don't have a chart, and you're not talking to anybody, and you're relying on your AIS, you just saw that this is the preferred way in.
3151780	3155660	And maybe somebody knows something that your chart doesn't.
3155900	3159660	And you'll actually run out of water somewhere around here.
3161260	3166800	That is my... I don't even know where anything is anymore.
3166800	3172160	That is my demo of spoofing.
3172280	3176360	So a couple things I want to say before I go over to Q&A.
3176360	3184800	Here's a picture of my wife herding fish, because I like to give that as an analogy of these problems.
3185280	3187560	Some of the stuff I've talked about is very, very real.
3187560	3190280	And you can pick up the newspaper and read about it all the time.
3190520	3196360	Some of the problems, you know, some people pass off and say, well, that's theoretically possible, but...
3197100	3203000	And, you know, there's a whole bunch of people in the community who have been making the, well, that's theoretical.
3203000	3205180	They've been making it practical for decades.
3205180	3207740	I like this quote by Arthur C. Clarke.
3208340	3213420	If an elderly but distinguished scientist says that something is possible, he's most certainly right.
3213420	3216300	If he says it's impossible, he's very probably wrong.
3217200	3222300	There's a lot of things that I can think of that are bad things that I could do.
3222300	3228400	I may not be able to do them today, but they might... the technology might catch up with me in the next couple of years.
3228400	3235040	And the last thing I want to give is a quick analogy and story, and then I'll be mostly done.
3235320	3240160	For those of you who are mariners, you recognize this lighting configuration.
3240540	3242280	Roll 27F.
3242380	3246580	This is a minesweeper engaged in minesweeping activity.
3246720	3254960	By the way, based on the red, white and green lights, it's aimed directly at you, which means you're already in the minefield.
3254960	3259100	But the analogy that I really want to use is this.
3259320	3263100	If you're in a minefield, what's your problem?
3263300	3273180	Is your problem the threat of the mine, or is it the vulnerability of your ship to the explosion?
3273580	3278760	And I ask that because, again, I'm going to give you a story out of early World War II history.
3278780	3283200	During the Battle of the Atlantic, the Germans came up with the idea of a magnetic mine.
3283200	3286400	So they planted magnetic mines in all sorts of places.
3286400	3297520	The way a magnetic mine got tripped was because when a battleship or any metal-hulled ship went over it, it disrupted the Earth's magnetic field sufficiently so that the mine could deploy.
3297740	3299760	The British figured that out.
3299760	3303260	They then figured out a way to degauss all of their ships.
3303260	3307260	And now they could go over magnetic mines and there was no problem.
3307260	3313880	The point is, what they did was fix the vulnerability of the ship.
3314120	3317320	That obviated the threat of the mine.
3317580	3321920	So when we're talking about threats and vulnerabilities, we need to know which to go after.
3321920	3324360	Basically, we can't stop all the threats.
3324360	3326720	We can find and fix our vulnerabilities.
3327280	3329600	In any case, here's some contact information.
3329600	3331260	I'll leave that up for now.
3331260	3334200	I'm going to go back to the beginning here.
3334400	3340060	And we have some time for Q&A if people have some Qs and As.
3345410	3347550	There are questions from Twitch.
3348170	3349150	Okay.
3349590	3353310	I'm trying to find out where I can get my...
3353310	3355410	Oh, I think I've gone too far.
3358860	3360840	I can get questions from AIS techs.
3360840	3366320	If there are questions, I'm not sure the best way to get them to me, but feel free to get them to me.
3372290	3373370	Let's see.
3376220	3378680	No, let's go back up here and see what we got.
3386360	3387720	Transmitting fake packets?
3388000	3391280	Yeah, you can actually transmit fake packets.
3391280	3395560	And I'm not 100% sure what devices will do.
3395560	3402540	If you're a legitimate ship, you send out your packet, it displays on the AIS, and then all of a sudden I send out a fake packet.
3402720	3404360	I'm sorry, you send out the real packet.
3404360	3406320	I followed up with a fake packet.
3406500	3412240	My suspicion is that other vessels are going to display the latest information they got.
3415630	3417550	You can, in fact, flood.
3417550	3420070	You can flood the system.
3420170	3422870	You can launch a denial of service on AIS.
3422870	3433270	You can cause some ships to go blind or get blinded and only be transmitting to effectively you as the attacker can see them.
3437110	3443910	AIS is mostly TDMA, but it's not strictly TDMA because it's self-organizing.
3448970	3450570	So let's see.
3450570	3453270	I'm getting a message over here on Slack.
3453270	3455670	What does the shadow have for me?
3456870	3458610	Oh, nothing over there.
3459250	3461530	Got a whole bunch of things over here.
3467270	3471110	Ah, a question from Twitch.
3471110	3473630	Did it figure out how the crop circle spoofing worked?
3473830	3481390	You know, I have not read anything that describes how the crop circle is working.
3481390	3488250	In fact, I have read a number of things where people at first were saying, we have no clue how they did this.
3490670	3493770	How realistic is the concern that AIS spoofing...
3493770	3494950	Oh, how do I get rid of this?
3494950	3495830	Oh, here we go.
3495830	3497550	Can lead to ship collisions.
3497630	3500590	Okay, so how realistic is the concern?
3500590	3512530	I don't know that it can lead to collisions per se, other than altering the information so that other vessels can't see that you're there.
3512530	3522650	So, for example, you know, the collisions with the U.S. Navy vessels, particularly the John McCain a couple years ago, were probably not due to anything like this.
3522650	3524290	And they did investigate it.
3524290	3541530	But if you don't have an appropriate watch and it's nighttime and you don't have good situational awareness, I can probably devise scenarios where ships get way closer to each other than they want to be.
3544230	3551830	There's a question here about incidents of spoofing on the space and control segments, not of which I am aware.
3555630	3558170	And readout's got a couple things.
3558990	3561950	Where did I get the vessel name for the Shanghai incident?
3563010	3571410	Well, certainly not from a secret document because I don't have access to those and I would be very careful about sharing it.
3571410	3574690	I got it. I must have gotten it from the Coast Guard.
3574690	3576050	So hang on two seconds.
3579170	3581270	That's Estella Imparo, right?
3581270	3587350	Yeah, I got something from U.S. Coast Guard NABCEN back.
3587350	3589150	Well, that's when it got reported.
3589290	3597570	So I guess I'm not 100% sure right now where I got it, but I know that it was out there somewhere.
3610680	3612080	Oh, dear.
3612480	3614360	I've now lost myself.
3620770	3622770	Oh, there was something I just missed there.
3623730	3625890	Something about the Fitzgerald.
3628530	3630790	Let me get back up here.
3639470	3644870	I heard some stuff about the Fitzgerald being subjected to any number of things.
3645370	3655950	I thought the latest that I'd read was that they said, sorry, it was operator error, because a lot of warships turn off their AIS.
3655950	3659510	Now, when they turn it off, they're still receiving, they're just not transmitting.
3660230	3662410	And I've actually been on a couple ships.
3662410	3663730	It's sort of funny.
3664130	3667570	I was on one boat where they could turn off their AIS.
3667570	3669190	They had a toggle switch.
3669310	3675370	Like, you know, a toggle switch like you could go to Lowe's and get a two-position toggle switch.
3675370	3679090	And then they had like a plastic label that said on-off.
3679090	3681550	And that was their AIS switch.
3681550	3683070	They could turn it on and off.
3685310	3689050	But I don't know the detail of the Fitzgerald.
3689050	3691790	I had not read that it was spoofed.
3691790	3695830	But if anybody has any detail about that you'd like to forward to me, I would love to see it.
3721820	3723240	Thank you very much.
3724780	3725940	My pleasure.
3727560	3731700	So, listen, I'm going to stay on for a few more minutes.
3731760	3734540	I know that I'm at the end of my witching hour.
3734720	3737260	If you've got more questions, obviously, feel free.
3737340	3739820	I will be taking the slides.
3740000	3745380	And within the next 10 or 15 minutes, I'll be making a PDF and I'll upload them.
3745380	3749320	Or I'll send them to the people who will upload them to places.
3750160	3753940	Obviously, anybody is welcome to contact me at any point about any of this.
3754440	3756580	I should give a little bit of an advertisement.
3757100	3769560	Some of the research that I've been doing for the last year and a half or so that caused me to build some of these tools was I came up with a demonstration and capability system to build a protected AIS, which I had a lot of fun doing.
3770120	3776880	I'm going to talk, I'll be talking about that tomorrow at, I think, I think is it four o'clock Eastern time?
3776880	3788780	So one o'clock Pacific time. And if anybody wants to sit in on that and, you know, I'll talk a little bit more about what AIS looks like and how I built in the protected code and, you know, that kind of stuff.
3789600	3791940	And I think that's that's it for now.
3791940	3796160	Otherwise, but like I said, I'll hang here for a couple of minutes before they kick me out.
3796160	3797280	But thank you all very much.