Notes · Exposure Assessment
Civil ADS-B Out on 1090 MHz carries no authentication and no encryption — the FAA states this directly. Cheap software radios proved practical injection over a decade ago. This note maps the public failure modes, the mitigations that actually exist, and where a deterministic evaluation fits. Status: research. No airframe work is claimed.
Every mode below is published, peer-reviewed, or regulator-stated. No private material was accessed. Assessment means measuring exposure against these modes with stated inputs and standards — it never means spoofing traffic, evading surveillance, or promising invisibility.
Correctly modulated false messages from inexpensive software radios; unsourced aircraft on controller and cockpit displays.Costin and Strohmeier (Eurecom, BlackHat 2012); Schäfer, Lenders, and Martinovic (ACNS 2013): safety-critical decisions should not rely on ADS-B alone.
Recorded traffic replayed; Mode-S hex and tail data swapped at will.Identifiers in cleartext are claims, not proof.
The Department of Defense actively fields non-appearance: encrypted Mode 5 IFF, feed filtering, temporary identifiers, procedural control, and refreshed mission systems.The threat is proliferated civil equipment — off-the-shelf receivers, crowd aggregators, and public gadgets — defeating those measures. Assessment tests the measures against the proliferation, program versus threat, with evidence attached.
Position originates in vulnerable civilian satellite feeds.Spoofed navigation becomes spoofed broadcast with no alarm raised by the protocol itself.
Independent timing networks raise the bar but recent real-world work (Senn et al., 2025) shows multi-device spoofing against deployed commercial multilateration is feasible with effort.Bar raised, not removed.
Off-the-shelf receivers feed public aggregators; fixed hex codes become long-term trackable profiles.Filtering programs limit registry linkage, not radio reception.
Controlled testbeds (12 attacks, 36 configurations) show received-signal-strength models near 90 percent spoof detection — promising as assessment instrumentation, not as a fielded claim.
FAA Privacy ICAO Address: temporary hex on 60-day rotation, domestic airspace, registry unlink — never radio silence.LADD: FAA feed filtering for participating vendors — never RF suppression. Military Mode 5 encrypted IFF under Mark XIIA with AIMS certification — the real encrypted answer, with COMSEC distribution as its hard part.
Public program record: Mission Communication System baseline not viable past calendar 2028; $73.3M refresh with about half approved; first delivery mid-2028, second mid-2029; bridge aircraft covering the gap.Wiring, power, cooling, structures, and certification converge now — evaluation staged before final checkouts avoids backtracking installed work.
1090 MHz captures with chain of custody, PAPR-style performance reports, TSO-C166b and TSO-C154c baselines, AC 20-165B and 20-172B installation guidance, AIMS 03-1000 series for military modes.
Same baselines plus STIG configuration discipline and Risk Management Framework review posture.Findings reproduce from evidence or they are not findings.
Exposure assessment per claim with evidence attached: which modes observed, which mitigations verified, what stayed unverified and held.
Assessment runs passive capture plus record analysis under written scope.Methods observe and measure; they transmit nothing, evade nothing, and ship no invisibility product. Exposure findings go to the operator with evidence, through the same inquiry-to-boundary path as everything else.
Bench reproduction against the cited literature with captured captures, a stated COMSEC distribution design, or a procedural-control demonstration with restricted-airspace coordination.
Proof
No airframe integration, no flight test, and no emissions claim exists behind this note. What exists is literature parity, a stated assessment method, and an integration window identified from public program record.
