Homeland Defense: Urgent Need for DOD and FAA to Address Risks and Improve Planning for Technology That Tracks Military Aircraft
Highlights
What GAO Found
Since 2008, the Department of Defense (DOD) and the Department of Transportation's Federal Aviation Administration (FAA) have identified a variety of risks related to Automatic Dependent Surveillance-Broadcast (ADS-B) Out technology that could adversely affect DOD security and missions. However, they have not approved any solutions to address these risks. Compared with other tracking technology, ADS-B Out provides more information, such as an aircraft's precise location, velocity, and airframe dimensions, and better enables real-time and historical flight tracking. Individuals—including adversaries—could track military aircraft equipped with ADS-B Out technology, presenting risks to physical security and operations. This readily available public information allowed GAO to track various kinds of military aircraft. ADS-B Out is also vulnerable to electronic warfare and cyber-attacks. Since FAA is planning to divest radars as part of ADS-B implementation, homeland defense could also be at risk, since the North American Aerospace Defense Command relies on information from FAA radars to monitor air traffic. DOD and FAA have drafted a memorandum of agreement that focuses on equipping aircraft with ADS-B Out but does not address specific security risks. Unless DOD and FAA focus on these risks and approve one or more solutions in a timely manner, they may not have time to plan and execute actions that may be needed before January 1, 2020—when all aircraft are required to be equipped with ADS-B Out technology.
Of the eight tasks associated with the implementation of ADS-B Out technology in the 2007 DOD NextGen memorandum—issued by the Deputy Secretary of Defense to ensure that the NextGen vision for the future national airspace system met DOD's requirements and the appropriate management of DOD's resources—DOD has implemented two, has partially implemented four, and has not implemented two. DOD has established a joint program office and identified a lead service, but it has only partially validated ADS-B Out requirements, developed a directive, issued an implementation plan, and incorporated NextGen into the planning, budgeting, and programming process. DOD has not taken significant action to integrate the needs and requirements of DOD components related to ADS-B into cohesive plans and policies for inclusion in NextGen joint planning and development, and has not provided periodic and recurring NextGen progress reports to the Deputy Secretary of Defense. As a result of DOD not fully implementing the 2007 NextGen memorandum, DOD components have lacked direction and cohesion while trying to address FAA's requirement to equip military aircraft.
This is a public version of a classified report GAO issued in January 2018.
Why GAO Did This Study
DOD has until January 1, 2020, to equip its aircraft with ADS-B Out technology that would provide DOD, FAA, and private citizens the ability to track their flights in real-time and track flight patterns over time. This technology is a component of NextGen, a broader FAA initiative that seeks to modernize the current radar-driven, ground-based air transportation system into a satellite-driven space-based system.
Senate Report 114-255 included a provision for GAO to assess the national defense implications of FAA's implementation of ADS-B. This report assesses the extent to which (1) DOD and FAA have identified operations and security risks and approved solutions to address these risks to ADS-B Out -equipped military aircraft; and (2) DOD has implemented key tasks in the 2007 memorandum on implementing NextGen.
GAO analyzed risks identified by DOD and FAA related to ADS-B vulnerabilities, and how they could affect current and future air defense and air traffic missions. GAO also reviewed the tasks in the 2007 NextGen Memorandum and assessed whether the eight tasks specifically related to ADS-B were implemented.
Recommendations
GAO is recommending that DOD and FAA approve one or more solutions to address ADS-B -related security risks; and that DOD implement key tasks to facilitate consistent, long-term planning and implementation of NextGen. DOD and the Department of Transportation generally concurred and described planned actions to implement the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Defense | The Secretaries of Defense and of Transportation should address ADS-B Out security concerns by approving one or more solutions that address ADS-B Out -related security risks or incorporating mitigations for security risks into the existing draft memorandum of agreement. These approved solutions should address operations, physical, cyber-attack, and electronic warfare security risks; and risks associated with divesting secondary-surveillance radars. The solution or mitigations should be approved as soon as possible in order to allow sufficient time for implementation. |
DOD and FAA have taken a number of actions to address the report's finding and recommendation. For example, in August 2018, DOD and the FAA signed a memorandum of agreement that that established a framework for DOD and FAA to jointly address the provision to allow certain aircraft not to broadcast and airspace monitoring and defense security issues related to ADS-B, and identifies a path to fully address the recommendations in our report. The memorandum of agreement was a first step to address the security issues we highlighted in the report. In 2019, the FAA provided the DoD relief from operating aircraft with ADS-B Out under Title 14 Code of Federal Regulations (CFR) ? 91.225. In late 2019, the FAA finalized two complementary accommodations for DOD aircraft not equipped with ADS-B or not transmitting ADS-B Out data due to physical and operational security (OPSEC) concerns. The FAA subsequently informed and trained their air traffic controllers and managers on these accommodations to ensure seamless and secure DOD air operations after the January 1, 2020, ADS-B Out mandate. According to DOD, the actions taken in 2019 marked a significant achievement toward common overarching interagency goals set forth in the 2018 ADS-B Out Accommodation Memorandum of Agreement. DOD has also informed us of additional actions it was taking with interagency partners to address operations, physical, cyber-attack, and electronic warfare security risks. We believe these actions address the intent of our recommendation.
|
| Department of Transportation | The Secretaries of Defense and of Transportation should address ADS-B Out security concerns by approving one or more solutions that address ADS-B Out -related security risks or incorporating mitigations for security risks into the existing draft memorandum of agreement. These approved solutions should address operations, physical, cyber-attack, and electronic warfare security risks; and risks associated with divesting secondary-surveillance radars. The solution or mitigations should be approved as soon as possible in order to allow sufficient time for implementation. |
DOD and FAA have taken a number of actions to address the report's finding and recommendation. For example, in August 2018, DOD and the FAA signed a memorandum of agreement that that established a framework for DOD and FAA to jointly address the provision to allow certain aircraft not to broadcast and airspace monitoring and defense security issues related to ADS-B, and identifies a path to fully address the recommendations in our report. The memorandum of agreement was a first step to address the security issues we highlighted in the report. In 2019, the FAA provided the DoD relief from operating aircraft with ADS-B Out under Title 14 Code of Federal Regulations (CFR) ? 91.225. In late 2019, the FAA finalized two complementary accommodations for DOD aircraft not equipped with ADS-B or not transmitting ADS-B Out data due to physical and operational security (OPSEC) concerns. The FAA subsequently informed and trained their air traffic controllers and managers on these accommodations to ensure seamless and secure DOD air operations after the January 1, 2020, ADS-B Out mandate. According to DOD, the actions taken in 2019 marked a significant achievement toward common overarching interagency goals set forth in the 2018 ADS-B Out Accommodation Memorandum of Agreement. DOD has also informed us of additional actions it was taking with interagency partners to address operations, physical, cyber-attack, and electronic warfare security risks. We believe these actions address the intent of our recommendation.
|
| Department of Defense | The Secretary of Defense should direct DOD components to implement key tasks that would facilitate consistent, long-term planning and implementation of NextGen--such as those tasks that the Deputy Secretary of Defense originally directed in 2007, or any tasks that the Secretary deems appropriate based on a current assessment of the original tasks. |
Subsequent to the issuance of our report, DOD identified tasks in the 2007 Deputy Secretary of Defense memorandum that remain relevant to facilitate FAA's NextGen's implementation. DOD determined that DOD Directive 5030.19, also signed by the Deputy Secretary of Defense, established DOD Responsibilities on Federal Aviation through the DOD PBFA and was constructed, in part, to perform key tasks that were set forth in the 2007 Deputy Secretary of Defense memorandum. DOD also found that several "partially implemented" tasks identified in our report are: (a) obsolete, because those tasks would have taken place during the planning phase; (b) have become obsolete, as threats evolved since the 2007 Deputy Secretary of Defense memorandum was published; or (c) have been implemented via the DOD PBFA and its DoD Directive 5030.19, DoD Responsibilities on Federal Aviation. DOD, DHS, and FAA continue to collaborate on identifying risks and appropriate mitigation strategies. Further, in late 2019, the DOD PBFA initiated a cross-functional and inter-departmental tiger team to conduct a comprehensive review and revision of DoD Directive 5030.19. The tiger team is focusing on three major lines of effort: (1) policy statements; (2) membership and responsibilities; and (3) NextGen Lead Service Office (LSO) disposition. Since many of the tasks outlined in the 2007 Deputy Secretary of Defense memorandum have been implemented, this Tiger Team will determine which relevant remaining tasks will be incorporated into enduring PBFA duties. In turn, this will yield which remaining NextGen LSO task(s), if any, should be incorporated into an update to the 2007 Deputy Secretary of Defense memorandum. Given DOD's assessment of the tasks identified in the 2007 Deputy Secretary of Defense memorandum and identification of actions that DOD and its components need to undertake in the future, we believe DOD has met the intent of the recommendation.
|