Drones Subject to GPS Spoofing, Privacy ‘Abuses,’ GAO Report Warns

Photo: U.S. Department of Defense

The Government Accountability Office is warning Congress that its push for drones to become commonplace in U.S. airspace fails to take into account concerns surrounding privacy, security and even GPS jamming and spoofing.

The GAO, Congress’ research arm, was responding to the FAA Modernization and Reform Act of 2012, signed by President Barack Obama in February, which among other things requires the Federal Aviation Administration to accelerate drone flights in U.S. airspace.

Drones, known in the report as “unmanned aerial systems,” are currently limited in the United States to law enforcement activities, search and rescue, forensic photography, monitoring or fighting forest fires, border security, weather research, and, among other things, scientific data collection and for hobby.

But there’s a concerted push to expand the commercial use of drones for pipeline, utility, and farm fence inspections; vehicular traffic monitoring; real-estate and construction-site photography; relaying telecommunication signals; fishery protection and monitoring; and crop dusting, according to the report (.pdf), which was distributed to lawmakers earlier this month.

That’s despite the fact that many drones don’t have “elaborate on-board detection systems to help them avoid crashes in the air,” which could cause complications when and if drones share airspace with private aircraft.

Among other things, the report urged the Transportation Security Administration to come up with a plan to secure operation centers for unmanned drones, recommended the government formulate privacy protections to head off “abuses” and also pointed out safety concerns that need to be addressed regarding GPS spoofing and jamming.

In a GPS jamming scenario, the UAS could potentially lose its ability to determine its location, altitude, and the direction in which it is traveling. Low-cost devices that jam GPS signals are prevalent. This problem can be mitigated by having a second or redundant navigation system onboard the UAS that is not reliant on GPS, which is the case with larger UAS typically operated by DOD and DHS.

The reported noted that “GPS jamming can be mitigated for small UAS by encrypting its communications, but the costs and weight associated with encryption may make it infeasible.”

What’s more, unencrypted non-military GPS signals are “vulnerable to being counterfeited, or spoofed.”

In a GPS-spoofing scenario, the GPS signal going from the ground control station to the UAS is “first counterfeited and then overpowered,” the report said. “Once the authentic (original) GPS signal is overpowered, the UAS is under the control of the ‘spoofer.’ This type of scenario was recently demonstrated by researchers at the University of Texas at Austin at the behest of DHS.”

The report comes three months after it was revealed that there are 64 drone bases on U.S. soil, with several private companies cleared to operate them. As for legal protections for citizens, “there is very little in American privacy law that prohibits drone surveillance within our borders,” points out Ryan Calo, the director for Privacy and Robotics at the Stanford Center for Internet and Society.

According to the GAO report, the government should set guidelines on drone spying which “could preclude abuses of the technology that could lead to a negative public perception of UAS and possibly affect their acceptance and use.”

FAA documents obtained by the Electronic Frontier Foundation via a Freedom of Information Act request indicate that dozens of local law enforcement agencies fly drones in U.S. airspace.

According to the EFF:

The Seattle Police Department’s drone comes with four separate cameras, offering thermal infrared video, low light ‘dusk-dawn’ video, and a 1080p HD video camera attachment. The Miami-Dade Police Department and Texas Department of Public Safety have employed drones capable of both daytime and nighttime video cameras, and according to the Texas Department of Public Safety’s Certificate of Authorization (COA) paperwork, their drone was to be employed in support of ‘critical law enforcement operations.’

The report noted that commercial and government drone expenditures could top $89 billion over the next decade.