text: Background FAA Next Generation Air Transportation System In December 2003 Congress enacted the Century of Aviation Reauthorization Act, laying the foundation for NextGen. The intent of NextGen is to increase air transportation-system capacity, enhance airspace safety, reduce delays experienced by airlines and passengers, lower fuel consumption, and lessen adverse environmental effects from aviation, among other benefits. This effort is a multi-year, incrementally iterative transformation that will introduce new technologies and leverage existing technologies to affect every part of the national airspace system. These new technologies will use an Internet Protocol-based network to communicate. NextGen consists of components that provide digital communications between controllers and pilots, and that also use satellite-based surveillance to aid in airspace navigation. Because of these new communication methods, NextGen increases reliance on integrated information systems and distribution of information, digital communication methods, and global positioning system (GPS) technology that may put the air traffic control system at greater risk for intentional or unintentional information-system failures and breaches. We have previously reported on progress that FAA has made in implementing NextGen. For example, in 2015 we found that FAA faces cybersecurity challenges in at least three areas: (1) protecting air-traffic control information systems, (2) protecting aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA offices. Among other recommendations, we recommended—and FAA concurred—that the agency should assess developing a cybersecurity threat model. Evolution of Tracking Military Aircraft in the National Airspace Historically, FAA and DOD capabilities have allowed both agencies—as well as NORAD—to monitor and track military aircraft flying in the national airspace. For example, FAA maintains two layers of radar—primary surveillance radar and secondary surveillance radar—to track and identify aircraft flying in the national airspace system. Primary surveillance radar identifies the location of aircraft flying in the national airspace by transmitting a signal and calculating the amount of time that passes until that signal bounces off the aircraft and returns to the radar. FAA also uses secondary surveillance radar that transmits an interrogation signal to aircraft flying in the national airspace. A receiver on the aircraft receives the interrogation signal and then transmits a broadcast back to this radar with flight information. Table 1 shows the evolution and capabilities of different transponders that broadcast aircraft information to receivers. The fields identified in the table are critical for identifying and tracking aircraft. Of the different transponder modes and technology, ADS-B Out provides the most precise and comprehensive data. ADS-B Out makes it easier for third parties to identify and track aircraft, as ADS-B Out broadcasts include registration number, precise location, aircraft dimensions, and other information. This additional information reduces the need to identify aircraft using private databases and to determine aircraft location by comparing time difference of arrival among receivers. The content of these aircraft broadcasts varies depending on the type of transmitter providing the information from the aircraft. For example, earlier broadcast systems, including the Mode 3/A and Mode C systems, transmit a temporary four-digit transmit code (commonly referred to as a squawk code) assigned by air traffic control that facilitates aircraft tracking during a single flight. Since FAA was the sole source of flight data for systems preceding Mode S, the agency could filter out military aircraft flight information for security reasons before providing information to the public about other aircraft flying in the national airspace. Mode S Transponder Mode S transponders provide more information than do the Mode 3/A and Mode C transponders. For example, the Mode S transponder broadcast identifies an aircraft-specific, 24-bit fixed address (commonly known as the ICAO address) assigned under International Civil Aviation Organization (ICAO) standards. An aircraft retains this fixed address based on its registration, and thereby facilitates aircraft identification until the aircraft is reregistered and receives a new ICAO address. FAA and aviation groups have reported that with the proliferation of commercial and amateur receivers, the public can now track individual aircraft by receiving the aircraft’s ICAO address, squawk code, and altitude. In addition, these entities have reported that since aviation groups and hobbyists have connected the receivers, the networked receivers can calculate and identify the latitude and longitude of the aircraft they are tracking. In addition, according to these reports, some groups maintain aircraft information databases and receiver networks that can identify aircraft by ICAO address and can locate aircraft by comparing the time difference of arrival of Mode S signals between three or more receivers. Using data derived from this work, interested parties— including adversaries (for example, foreign intelligence entities, terrorists, and criminals)—can identify military aircraft by type and registration number, and can track the aircraft while in flight through Mode S fixed address broadcasts. Using this readily available public information, we were able to track various kinds of military aircraft that were equipped with Mode S transponders. ADS-B Technology ADS-B consists of two distinct aircraft information services, ADS-B Out and ADS-B In. As previously stated, ADS-B Out technology is one of the main components of FAA’s NextGen effort. It is a performance-based surveillance technology using GPS-enabled satellites to produce flight information, such as an aircraft’s location and velocity, and according to FAA, it is more precise than radar. These precise data provide air traffic controllers and pilots with more accurate information to keep aircraft safely separated in the national airspace. This technology combines aircraft avionics, a positioning capability, and ground infrastructure to enable accurate transmission of information from aircraft to the air traffic control system. This technology periodically transmits information without a pilot or operator involved (that is, Automatic); collects information from GPS or other suitable navigation systems (that is, Dependent); provides a method of determining 3-dimensional position and identification of aircraft, vehicles, or other assets (that is, Surveillance); and transmits the information available to anyone with the appropriate receiving equipment (that is, Broadcast). Using this readily available public information, we were able to track various kinds of military aircraft that were equipped with ADS-B transponders. ADS-B In is the technology that enables receivers to have direct access to information broadcasted through ADS- B Out transponders. FAA’s final rule requiring all aircraft that fly in certain categories of airspace to equip with ADS-B by January 1, 2020, applies to the ADS-B Out technology. FAA has not issued a rule or requirement for aircraft to equip with the ADS-B In technology, as of July 2017. However, according to representatives from Airlines for America, an airline industry advocacy organization, airlines have begun to install the ADS-B In capability on commercial aircraft due to the benefits they anticipate from the capability (for example, the ability of passenger airliners to reduce separation standards to save time and reduce fuel consumption). In addition, according to Air Force officials, the Air Force plans to install ADS-B In on future KC-46 transport/tanker aircraft. This report focuses on the ADS-B Out requirement when referencing ADS-B technology unless otherwise noted. According to DOD and FAA documents and officials, FAA has identified ADS-B implementation as providing an opportunity to save costs by divesting a number of secondary-surveillance radars. According to FAA officials, as of April 2017 the agency was re-evaluating its original ADS-B backup strategy and the need for retaining additional secondary- surveillance radars. According to these officials, FAA plans to maintain all high-altitude secondary-surveillance radars and the low-altitude secondary-surveillance radars around 30 or more of the busiest airports. Relationship between FAA and DOD in Managing National Airspace The FAA and DOD are to cooperate in order to regulate airspace use. Specifically, the FAA is responsible for providing air navigation services, including air traffic control across most of the United States, and is leading the overall NextGen efforts in the United States. The FAA’s air traffic control system works to prevent collisions involving aircraft operating in the national airspace system, while also facilitating the flow of air traffic and supporting national security and homeland defense missions. In addition, in accordance with International Civil Aviation Organization guidelines, the FAA has categorized airspace as controlled, uncontrolled, or not used in the United States. According to the ADS-B Out rule, after January 1, 2020, no person may operate an aircraft in certain categories of airspace defined by the rule unless otherwise authorized by air traffic control authorities. DOD conducts its missions within the national airspace system as both an aircraft operator and, as delegated by the FAA, as provider of air traffic control and other air navigation services. DOD has the authority to certify its own aircraft, manage airspace, and provide air traffic control-related services in accordance with FAA requirements. DOD also provides guidance to FAA concerning security matters pertaining to the national airspace system. DOD is responsible for ensuring that DOD components, such as the military services, have sufficient access to airspace to meet security requirements, and that civilian and military aircraft can operate safely both domestically and abroad. DOD also releases airspace to the FAA when it does not need the space for military purposes. The FAA also works with DOD to ensure aviation safety between civil and military aircraft. The FAA designates airspace over certain parts of the United States as Special Use Airspace, because the areas may have prohibited airspace, restricted airspace, warning areas, or alert areas. It might be hazardous for civil aircraft to operate in that restricted airspace due to these designations. Special Use Airspace allows military aircraft to operate safely in separate, clearly defined airspace in order to conduct missions in support of the National Security Strategy and the National Military Strategy. The FAA also issues safety briefings that could identify military-protected, temporarily flight-restricted areas, to prevent civil pilots from flying into the airspace. These briefings also include information such as flight safety advice and information on air traffic technology, such as ADS-B. The FAA also shares radar information with NORAD to support the defense of North America over areas such as the National Capital Region surrounding Washington, D.C. Roles and Responsibilities The FAA is responsible for providing airspace navigation services within the United States and has a particular entity—the FAA Office of NextGen—that directs its NextGen requirements. In 2007 the Deputy Secretary of Defense designated the Air Force as the lead service for representing DOD and for leading and coordinating efforts across DOD. To accomplish this responsibility, the Air Force established a Lead Service Office, hereinafter referred to as the DOD Lead Service Office. These and numerous other entities have a role in implementing NextGen and ADS-B, as shown in table 2 below. DOD and FAA Have Identified Security and Mission Risks Related to ADS-B Out Technology but Have Not Approved Any Solutions to Mitigate Them Since 2008, DOD and FAA have identified a variety of ADS-B- related risks that could adversely affect military security and missions. While DOD and FAA have identified some potential mitigations for these risks, the departments have not approved any solutions. DOD and FAA Have Identified Risks to DOD Security and Missions Related to ADS-B Technology Documents we reviewed and officials we met with identified a variety of operations and physical security risks that could adversely affect DOD missions. These risks arise from information broadcast by ADS-B itself, as well as from potential ADS-B vulnerabilities to electronic warfare- and cyber-attacks, and from the potential divestment of secondary- surveillance radars. ADS-B Information Presents Operations and Physical Security Risks Information broadcasted from ADS-B transponders poses an operations security risk for military aircraft. For example, a 2015 assessment that RAND conducted on behalf of the U.S. Air Force stated that the broadcasting of detailed and unencrypted position data for fighter aircraft, in particular for a stealth aircraft such as the F-22, may present an operations security risk. The report noted that information about the F- 22’s precise position is classified Secret, which means that unauthorized disclosure of this information could reasonably be expected to cause serious damage to the national security. Similarly, in 2012 MITRE issued a report on behalf of the DOD Lead Service Office that identified a number of risks—including the ability to track movement in and out of restricted airspaces and changes in operations—to ADS-B-equipped aircraft. In addition to these documents, DOD officials identified a number of increased operations and physical security risks associated with aircraft equipped with ADS-B technology. In DOD’s 2008 comments about FAA’s draft rule requiring ADS-B Out technology, the department informed FAA that DOD aircraft could be identified conducting special flights for sensitive missions in the United States and potentially compromised due to ADS-B technology. Such sensitive missions could include low-observable surveillance, combat air patrol, counter-drug, counter-terrorism, and key personnel transport. While some military aircraft are currently equipped with Mode S transponders that provide individuals who have tracking technology the altitude of the aircraft, ADS- B poses an increased risk. Specifically, according to documents we reviewed and officials we met with, a confluence of the following three issues has led to ADS-B technology presenting more risks to DOD aircraft, personnel, equipment, and operations: Additional information. The additional information provided through ADS-B technology— including the aircraft’s precise location, velocity, and airframe dimensions—increases both direct physical risks to DOD aircraft, personnel, and equipment, and long-term risks to DOD air operations. Accessibility of information. ADS-B technology also introduces risks to aircraft, personnel, equipment, and operations, because it provides information to the public that was not previously accessible. FAA filters information about DOD’s flights so that the information is not available to the public via any FAA data feed. According to FAA officials, this filtering was effective for protecting such information for Mode-S equipped DOD aircraft until the 2012 timeframe, when the capability of third-party networked receivers started to allow position determination for such aircraft. With ADS-B, aircraft location and other information is broadcast from the aircraft, where FAA cannot filter it. While individuals and groups could obtain additional information about DOD flights operating with Mode S, such as an aircraft’s fixed address, information such as geographic location and velocity was not included in broadcasts. Individuals could estimate location and velocity of DOD flights by locating the signal through privately owned receiver networks. By equipping military aircraft with ADS-B technology, individuals and groups would receive additional identifiers, location information, and airframe information through aircraft broadcasts and, as a result, could identify and track aircraft without the use of fixed address databases and with less receiver infrastructure. Historical data. ADS-B technology better enables individuals and groups to track flights in real time and use computer programs to log ADS-B transmissions over time. Therefore, individuals or groups could observe flight paths in detail, identify patterns-of-life, or counter or exploit DOD operations. ADS-B Could Affect Current and Future Air Defense and Air Traffic Missions While NORAD and DOD officials told us that they will benefit from information provided by ADS-B technology, NORAD, DOD, and professional organizations’ documents and officials also noted that electronic warfare- and cyber-attacks—and the potential divestment of secondary-surveillance radars as a result of reliance on ADS-B—could adversely affect current and future air operations. For example, a 2015 Institute of Electrical and Electronics Engineers article about ADS-B stated that ADS-B is vulnerable to an electronic- warfare attack—such as a jamming attack—whereby an adversary can effectively disable the sending and receiving of messages between an ADS-B transmitter and receiver by transmitting a higher power signal on the ADS-B frequencies. The article notes that while jamming is a problem common to all wireless communication, the effect is severe in aviation due to the system’s inherently wide-open spaces, which are impossible to control, as well as to the importance and criticality of the transmitted data. As a stand-alone method, jamming could create problems within the national airspace. Jamming can also be used to initiate a cyber-attack on aircraft or ADS-B systems. According to the article in the 2015 Institute of Electrical and Electronics Engineers publication, adversaries could use a cyber-attack to inject false ADS-B messages (that is, create “ghost” aircraft on the ground or air); delete ADS-B messages (that is, make an aircraft disappear from the air traffic controller screens); and modify messages (that is, change the reported path of the aircraft). The article states that jamming attacks against ADS- B systems would be simple, and that ADS-B data do not include verification measures to filter out false messages, such as those used in spoofing attacks. FAA officials stated that the agency is aware of these possible attacks, and that it addresses such vulnerabilities by validating ADS-B data against primary- and secondary-surveillance radar tracks. Both FAA and DOD have identified a potential solution to address this vulnerability. However, this solution has not been tested and as of November 2017, no testing has been scheduled. In addition to electronic warfare- and cyber-attacks, both NORAD and DOD officials expressed concerns that the air defense and military air traffic control missions would be affected if FAA were to divest secondary- surveillance radars following ADS-B implementation. According to DOD and FAA documents and officials, FAA has identified ADS-B implementation as an opportunity to save costs by divesting a number of secondary-surveillance radars. However, according to NORAD and DOD officials, in those locations where FAA divests of radars, the missions would be at higher risk if an aircraft operator were to turn off the aircraft’s ADS-B technology; if an adversary were to conduct an electronic or cyber-attack on the ADS-B system; or if the ADS-B system were to experience a technical failure. According to NORAD command officials, the command relies on information from FAA radars to monitor air traffic in the national airspace system. If an aircraft is operating without ADS-B, if a GPS or ADS-B system fails, or if an adversary has jammed an aircraft’s GPS signal or ADS-B transmissions, then the command will have to rely on primary- and secondary-surveillance radar to track the aircraft’s location. FAA officials stated that FAA is chiefly responsible for air safety, while NORAD and DOD are chiefly responsible for air defense, and that they believe there will be sufficient radar coverage for DOD to conduct its missions. FAA officials stated that they will maintain sufficient backup systems to ensure air traffic safety for all flights, and will maintain radar in excess of their needs to support NORAD’s missions. FAA officials stated that they will maintain all primary-surveillance radar, all high-altitude secondary-surveillance radar, and low-altitude secondary-surveillance radar near at least thirty major flight terminals. However, according to NORAD and DOD officials, FAA has not proposed an updated legacy primary- and secondary-surveillance radar divestment plan since 2012 for use by NORAD and DOD in assessing potential effects on the mission. NORAD is a bi-national command that requires support from U.S. federal agencies—not just DOD—and relies on FAA radar to support its mission, and it will need to ensure that sufficient air surveillance resources are in place. DOD and FAA Have Not Approved Any Solutions to Address ADS-B Risks Although DOD, FAA, and other organizations have identified risks to military security and missions since 2008, DOD and FAA have not approved any solutions to address these risks. This is because DOD and FAA have focused on equipping military aircraft with ADS-B technology and have not focused on solving or mitigating security risks from ADS-B. The approach being taken by FAA and DOD will not address key security risks that have been identified, and delays in producing an interagency agreement have significantly reduced the time available to implement any agreed-upon solutions before January 1, 2020, when the full deployment of ADS-B Out is required. Federal internal control standards state that federal agencies should make risk-based decisions in a timely manner. Specifically, OMB Circular A-123 states that management should evaluate and document internal control issues and determine appropriate corrective actions for internal control deficiencies on a timely basis. In the case of equipping military aircraft with ADS-B technology and addressing any risks associated with it, DOD and FAA have shared responsibility. In 2008 DOD informed FAA that military aircraft would need special accommodations to the ADS-B Out rule due to national security concerns, such as sensitive missions and electronic warfare vulnerabilities. In 2010 FAA responded to DOD’s comments to the draft ADS-B Out rule stating that the agency would collaborate with departments or agencies, including DOD and the Department of Homeland Security, to develop memorandums of agreement to accommodate their national defense mission requirements while supporting the needs of all other national airspace system users. Since that time, DOD components have identified actions that could mitigate some of the risks. For example, DOD and others have identified such mitigations as masking DOD aircraft identifiers, maintaining current inventory of primary-surveillance radars, allowing pilots to turn off ADS-B broadcasts, and seeking an exemption from installing ADS-B technology on select military aircraft (for example, fighter and bomber aircraft). However, as of June 2017—almost 7 years after FAA acknowledged that it would address DOD’s concerns (and less than 3 years before full deployment of ADS-B Out is required)—DOD and FAA have not approved any solutions to these risks. The DOD’s Lead Service Office and FAA have focused on developing a memorandum of agreement that they hope will create a framework for future collaboration at the local level. However, our work and that of NORAD and other DOD components identified a number of limitations to DOD’s Lead Service Office and FAA’s dependence on this draft memorandum of agreement. For example, the draft memorandum does not address the following: the details necessary to establish solutions or mitigations between DOD and FAA for identified security risks. The draft memorandum focuses on equipage of ADS-B technology on military aircraft, cost estimates, and agency and office responsibilities. DOD acknowledges that it will equip military aircraft with ADS-B technology and operate to the greatest extent possible by the January 1, 2020, compliance date. However, the draft memorandum does not identify solutions for the identified operations and physical security risks. the electronic warfare and cyber-attack concerns and the effect on sensitive defense missions that DOD has identified. the flexibility required by NORAD to support freedom of movement within the continental United States, Alaska, and Canada airspace for military missions. The draft memorandum would place negotiating accommodations for NORAD’s bi-national mission at the local level— an act that NORAD officials characterized as unfeasible because military aircraft supporting NORAD missions require uninhibited airspace access throughout the United States and Canada, as a response may be required anywhere and at any time. According to NORAD officials, the command would incur a significant burden to finalize memorandums of agreement with more than 600 air traffic control facilities and ensure commonality with all facilities in the continental United States and Alaska. Furthermore, NORAD officials stated that these missions should not be limited by local restrictions created by the ADS-B Out rule. For example, DOD aircraft flying over one state while supporting an Operation Noble Eagle mission could be stationed at a military base in another state and thus not have an agreement with local FAA controllers. potential mission risks associated with the divestment of secondary- surveillance radars. Delays in the completion of a memorandum of agreement have exacerbated uncertainty as to whether security issues will be addressed in any manner. DOD and FAA have met to discuss the existing draft memorandum of agreement since December 2016. In April 2017 officials from DOD Lead Service Office told us that they expected DOD and FAA to finalize the memorandum of agreement by June 2017; however, in May 2017 DOD officials informed us that the estimated completion date had slipped to February 2018. A significant amount of work will likely need to be accomplished between the eventual approval of the memorandum and implementation in a timely manner. For example, FAA officials acknowledged that the agency would need to issue, update, or both issue and update internal guidance once the memorandum is signed prior to local FAA officials being able to negotiate and agree to arrangements with local military commanders. Similarly, the draft memorandum, if approved, would place a significant burden on local DOD entities to negotiate agreements. For example, the Army expressed concerns that local negotiations—at 76 locations, according to Army estimates—would take from 1 to 2 years to complete after FAA and DOD have signed the memorandum of agreement. Army officials also highlight concerns that local FAA air traffic controllers may not enter into agreements with Army units, or that local agreements will be contingent upon the density of local air traffic or the personalities of those negotiating the agreements. Additionally, assuming that actions are agreed upon among the key stakeholders—DOD, FAA, and NORAD—to resolve or mitigate the identified security risks, DOD, FAA and NORAD will need sufficient time to implement these actions. This is due to the complexity of the ADS-B vulnerabilities and potential mitigations for operations and physical security, electronic warfare, cyber-attack, and potential effects of secondary-radar divestment. As of June 2017, DOD and FAA had not identified any other solutions that could address the risks and concerns identified by DOD and others since 2008. Unless FAA and DOD approve one or more solutions that address all the risks associated with ADS-B technology, DOD security and military missions could face unmitigated risks. These include physical, cyber- attack, and electronic warfare security risks, as well as risks associated with divesting secondary-surveillance radars. Furthermore, unless FAA and DOD focus on the security risks of ADS-B and approve one or more solutions in a timely fashion, they may not have time to plan for and execute any technical, programmatic, or policy actions that may be necessary before all of DOD’s aircraft are required to be equipped with ADS-B technology on January 1, 2020. DOD Has Achieved Mixed Implementation of Key ADS-B Tasks Directed in 2007 Of the eight tasks associated with the implementation of ADS-B Out technology in the 2007 DOD NextGen memorandum—issued by the Deputy Secretary of Defense to ensure that the NextGen vision for the future national airspace system met DOD’s requirements and the appropriate management of DOD’s resources—DOD has implemented two, has partially implemented four, and has not implemented two. Specifically, we found that DOD has implemented the following two tasks: Establishing a Joint Program Office. The Deputy Secretary of Defense directed the Secretary of the Air Force to establish and provide administrative support for a DOD Joint Program Office for NextGen. According to the 2007 NextGen memorandum, the office is responsible for coordinating DOD activities related to the NextGen effort, facilitating technology transfer for those research and development activities with potential NextGen application, and advocate for DOD interests, requirements, and capabilities in NextGen. The Air Force established a Joint Program Office to provide services to the entire military aviation community on communication navigation surveillance/air traffic management issues in various capacities. Officials from the DOD Joint Program Office told us that the office has tested various avionic systems for methods of meeting ADS-B requirements. The office has also established an Internet portal for the services to order avionics, including those associated with ADS-B technology. Appointing a DOD representative to the FAA’s interagency Joint Planning and Development Office. The 2007 NextGen memorandum directed that the Secretary of the Air Force appoint a DOD representative to the Joint Planning and Development Office’s board of directors responsible for assisting in the development and coordination of DOD-wide policies and decisions concerning NextGen. In March 2012 DOD’s Lead Service Office appointed an Air Force officer who also manages the DOD Lead Service Office as the DOD representative to the FAA’s interagency Joint Planning and Development Office. DOD partially implemented the following four tasks: Validating NextGen program requirements. The 2007 NextGen memorandum directed that the Secretary of the Air Force document and seek validation for NextGen program requirements through the Joint Capabilities Integration Development System process. The Air Force took the initial step in having its NextGen program requirements validated through DOD’s Joint Capabilities Integration Development System process in October 2014. However, the focus of the assessment was on the Air Force’s requirements and not that of other military services or components. This is not fully consistent with the 2007 memo, which states that the Air Force—as the lead service— should integrate the needs and requirements of the DOD components into cohesive plans and policies for inclusion in NextGen joint planning and development. Establishing guidance on DOD NextGen responsibilities and objectives. The 2007 NextGen memorandum directed the Assistant Secretary of Defense for Homeland Defense and Global Security, the DOD Chief Information Officer, and the Director of Administration, in consultation with the DOD Lead Service, to submit a proposed DOD directive within 180 days specifying the department’s objectives with respect to NextGen and the continuing roles and responsibilities of the Lead Service and the DOD Policy Board on Federal Aviation. In 2013, about 5 years after the original due date for the180-day requirement, DOD updated its DOD Directive 5030.19, DOD Responsibilities on Federal Aviation. While the updated directive references the responsibilities of the DOD Policy Board on Federal Aviation and the Secretary of the Air Force, per the 2007 NextGen memorandum, the directive does not specify DOD’s objectives with respect to NextGen, as required by the memorandum. Developing an initial plan defining actions, responsibilities, and milestones for DOD’s NextGen efforts: The 2007 NextGen memorandum required DOD’s Lead Service, in coordination with the principal members of the DOD Policy Board on Federal Aviation, to develop an initial plan defining actions, responsibilities, and milestones for DOD’s participation in the NextGen efforts and FAA’s Joint Planning and Development Office. This initial plan was to include an implementation plan for the NextGen Joint Program Office and was to be updated semiannually. In 2013 the Air Force, in executing its responsibilities as Lead Service, issued a DOD NextGen Implementation Plan to describe the strategy, principles, and actions for the transition of DOD aviation operations (air and ground) to the national airspace system environment defined by FAA in its NextGen Implementation Plan. We found that the 2013 plan identified responsibilities of DOD components and established indicators meant to give a sense of progress made in NextGen implementation. However, the plan did not include detailed transition planning for ADS- B and was not updated semiannually, as required. Incorporating NextGen into the planning, budgeting, and programming process: According to the 2007 NextGen memorandum, the Secretary of the Air Force is to coordinate DOD- wide NextGen planning, budgeting, and programing guidance in conjunction with the Under Secretary of Defense for Policy and the Director of Program Analysis and Evaluation for consideration in the formulation of planning and programming guidance documents. The memorandum also directed DOD components to coordinate with the Air Force on NextGen programs they agreed to support using inter- service memorandums of understanding, and to fund procurement through service annual program objective memorandum processes. DOD provided evidence that the military departments used the program objective memorandum process to fund ADS-B Out. However, the DOD Lead Service Office did not provide department- wide planning, budgeting, and programming guidance for ADS-B or any other NextGen elements to DOD components. Similarly, DOD did not provide any inter-service memorandums of understanding that would document NextGen programs that the services agreed to fund. According to officials from the DOD Lead Service Office, this office is not responsible for planning, budgeting, and programming because the office is organizationally located within the Air Force Headquarters Office of the Deputy Chief of Staff for Operations. However, while the office may not be responsible for planning, budgeting, and programming within the Air Force, the office can issue—or coordinate the issuance—of such guidance, as directed by the Deputy Secretary of Defense. DOD had not taken significant action or fully implemented the following two actions: Integrating NextGen requirements into plans and policies: The Secretary of the Air Force, in executing the service’s responsibilities as Lead Service, did not integrate the needs and requirements of DOD components related to ADS-B into cohesive plans and policies for inclusion in NextGen joint planning and development, as directed by the Deputy Secretary of Defense in 2007. According to officials from the DOD Lead Service Office, they met the intent of these tasks through the 2012 United States Air Force Next Generation Air Transportation System Keystone Document, the 2013 Department of Defense (DOD) Mid-Term NextGen Concept of Operations, and the 2013 Department of Defense (DOD) Mid-Term Next Generation (NextGen) Implementation Plan. However, the Air Force NextGen Keystone Document applies to the Air Force and not to NORAD or other DOD components. In addition, the DOD Mid-Term NextGen Concept of Operations and the DOD Mid-Term NextGen Implementation Plan do not discuss planning for ADS-B Out requirements, which are critical to NextGen. Providing periodic and recurring NextGen progress reports: The Assistant Secretary of Defense for Homeland Defense and Global Security did not provide periodic and recurring NextGen progress reports to the Deputy Secretary of Defense, as instructed in the 2007 NextGen memorandum. According to the memorandum, the Assistant Secretary was designated as the principal staff assistant for NextGen and was responsible for oversight, support, and advocacy for the lead service with respect to the interagency and Joint Planning and Development Office. Officials from the Office of the Deputy Assistant Secretary of Defense for Homeland Defense Integration and from Defense Support to Civil Authorities acknowledged that the Office of the Assistant Secretary of Defense for Homeland Defense and Global Security had not tracked ADS-B implementation or provided progress reports to the Deputy Secretary of Defense—with the exception of advocating for ADS-B installation exemptions for aircraft that could not comply with the mandate—for retention of ground-based radars, and some minimal advocacy related to compliance with the FAA ADS-B Out rule. DOD could not provide a clear explanation with regard to those requirements that we determined not to have been fully implemented. Officials from the DOD Lead Service Office provided a number of potential reasons to explain why the memorandum’s tasks might not have been fully implemented. For example, as noted earlier, officials stated that other documents captured those requirements. Further, officials told us they believe that implementation of many of the preceding tasks was accomplished through other means, although our analysis concluded that the task was either not implemented or was partially implemented, as noted previously. These officials also noted that—although there is no expiration date on the 2007 NextGen memorandum—many DOD officials consider such memorandums to be applicable for 12 to 18 months. In addition, DOD Lead Service Office officials noted that many DOD components had not assigned a high level of priority to NextGen implementation. As a result of DOD’s not fully implementing the 2007 NextGen memorandum—including developing or revising a DOD directive that specifies DOD’s objectives with respect to NextGen, issuing an implementation plan that includes detailed transition planning for ADS-B and is updated semiannually, and providing recurring progress reports to the Deputy Secretary of Defense—DOD components have lacked direction and cohesion while trying to address FAA’s requirement to equip military aircraft. For example: Officials from the Air Force Life Cycle Management Center’s Fighters and Bombers Directorate told us that they have not been provided any guidance. The directorate does not intend to install ADS-B technology on Air Force fighters or bombers until they receive DOD guidance. Yet, the deadline to equip DOD aircraft that will fly in the national airspace remains January 1, 2020. DOD does not have a coordinated or accurate schedule for equipping ADS-B technology on military aircraft. Although DOD submitted a schedule to Congress in June 2015, officials from the DOD Lead Service Office told us that the timeframes for that plan were no longer accurate, and that the plan would be updated as part of the memorandum of agreement in February 2018. Some DOD components have installed or plan to install civilian GPS receivers on their aircraft to meet FAA’s ADS-B technical requirements. According to DOD officials, DOD aircraft that equip with commercial GPS receivers will not be as protected from GPS security issues as they would have been had they used a military GPS receiver. According to officials from the Office of the DOD Chief Information Officer, the office with primary responsibility for GPS receiver security policy, no one within DOD—including the DOD Lead Service Office or other DOD components—had made them aware that DOD components were installing civilian receivers on aircraft. Since—according to an official within the DOD Lead Service Office— neither the Office of the Assistant Secretary of Defense for Homeland Defense and Global Security nor any other elements of the Office of the Under Secretary of Defense for Policy were engaged in discussion regarding the draft memorandum of agreement with the DOD Lead Service Office and FAA, the Secretary of Defense’s senior policy advisor may not be aware of provisions that may be incorporated in the agreement. For example, the draft memorandum of agreement contains a provision that could result in the department’s being financially responsible for sharing the costs of sustaining secondary- surveillance radars. According to a 2007 FAA document, it will cost FAA approximately $442 million to maintain these radars from fiscal years 2017 to 2035. If DOD components do not fully implement key tasks that would facilitate assurance of DOD requirements in the future NextGen system and appropriate management of DOD resources—such as those tasks that the Deputy Secretary of Defense originally directed in 2007, or any tasks that the Secretary deems appropriate—DOD may risk having less efficient and less effective implementation of NextGen requirements, increased costs of implementation, or missed opportunities to address operations risks. Conclusions The NextGen system has the potential to increase the efficiency and effectiveness of the nation’s expanding air traffic. As with many such procedural and technological innovations, DOD stands to benefit from NextGen’s vision. As is the case with all such electronic and cyber systems in the information age, this must be balanced with sufficient consideration of the operations and security effects for DOD. DOD and FAA have not approved any solutions that address risks resulting from ADS-B on DOD aircraft—including operations, physical, cyber, and electronic warfare security risks, as well as risks associated with divesting secondary-surveillance radars. Unless DOD and FAA focus their efforts on the security aspects of ADS-B on DOD aircraft and produce one or more solutions to these risks, DOD aircraft and missions will be exposed to unmitigated risks that could jeopardize safety, security, and mission success. Also, unless DOD fully implements the tasks that would facilitate consistent, long-term planning and implementation of NextGen throughout the department, DOD’s full integration into the NextGen system and the integrity and security of DOD’s forces and missions will be hindered. Given the amount of time that has transpired since DOD initially raised security concerns in 2008 and the amount of time it will take to formalize, operationalize, and train employees to implement any agreements prior to the January 1, 2020, deadline, it is critical that both DOD and FAA make this a high priority. Recommendations for Executive Action We are making two recommendations, including one to the Secretaries of Defense and Transportation, and one to the Secretary of Defense: We recommend that the Secretaries of Defense and of Transportation address ADS-B Out security concerns by approving one or more solutions that address ADS-B Out -related security risks or incorporating mitigations for security risks into the existing draft memorandum of agreement. These approved solutions should address operations, physical, cyber-attack, and electronic warfare security risks; and risks associated with divesting secondary-surveillance radars. The solution or mitigations should be approved as soon as possible in order to allow sufficient time for implementation. We recommend that the Secretary of Defense direct DOD components to implement key tasks that would facilitate consistent, long-term planning and implementation of NextGen—such as those tasks that the Deputy Secretary of Defense originally directed in 2007, or any tasks that the Secretary deems appropriate based on a current assessment of the original tasks. Agency Comments and Our Evaluation We provided a draft of the report to DOD and the Department of Transportation for review and comment. Written comments from DOD on the classified draft and from the Department of Transportation on this report are reprinted in their entirety in appendixes II and III, respectively, and summarized below. DOD and the Department of Transportation also provided technical comments, which we incorporated as appropriate. The Department of Transportation concurred and DOD partially concurred with the first recommendation to approve one or more solutions that address ADS-B Out security risks or incorporating mitigations for security risks into the existing draft memorandum of agreement and that these solutions should address operations, physical, cyber-attack, and electronic warfare security risks as well as risks associated with divesting secondary-surveillance radar. In its written comments, the Department of Transportation stated that it has recently developed and is now in the process of validating military flight tracking risk mitigation solutions that are technologically viable and operationally effective. Both the Department of Transportation and DOD stated that they would approve one or more solutions to address ADS-B Out related security risks. For example, both departments stated that among other actions, they would complete a memorandum of agreement between FAA and DOD that would incorporate security concerns identified in the report. DOD estimated that the memorandum of agreement will be signed in February 2018. We believe the steps identified by both the Department of Transportation and DOD, if implemented as planned, would meet the intent of our recommendation. DOD partially concurred with the second recommendation to implement key tasks that would facilitate consistent, long-term planning and implementation of NextGen—such as those tasks that the Deputy Secretary of Defense originally directed in 2007 or any tasks that the Secretary deems appropriate based on a current assessment of the original tasks. DOD stated the Secretary of the Air Force would identify within the next 120 days which relevant key tasks would facilitate the implementation of NextGen to include assessing the status of tasks that were directed in the Deputy Secretary of Defense memorandum, “Implementation of the Next Generation Air Transportation within the Department of Defense 2007.” DOD stated that the assessment would include a comprehensive review of modernization efforts regarding NextGen and other global initiatives and that includes suitable security and cybersecurity mitigation measures. DOD also stated that the Policy Board for Federal Aviation would track key task implementation in coordination with the Secretary of the Air Force and other appropriate DOD officials. This would also include periodic updates to the Deputy Secretary of Defense. We believe these steps would meet the intent of our recommendation if implemented as planned. We are sending copies of this report to the appropriate congressional committees; the Secretary of Defense; the Secretary of Homeland Security; the Secretary of Transportation; and the commander of NORAD. We are also sending copies to the Under Secretary of Defense for Policy; the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Chairman of the Joint Chiefs of Staff; the Secretaries of the military departments; and the Administrator of FAA. In addition, the report is available at no charge on the GAO website http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9971 or kirschbaumj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology Senate Report 114-255, accompanying a bill for the National Defense Authorization Act of Fiscal Year 2017, included a provision that we assess issues related to the defense implications of implementation of the Federal Aviation Administration’s (FAA) Next Generation Air Transportation System (NextGen) and Automatic Dependent Surveillance—Broadcast (ADS-B), a main component of NextGen. This report assesses the extent to which (1) the Department of Defense (DOD) and the FAA have identified security and operations risks and approved solutions to address these risks to military aircraft equipped with ADS-B Out technology; and (2) DOD has implemented key tasks in the 2007 Deputy Secretary of Defense memorandum on implementing NextGen. The scope of our review included all DOD and Department of Transportation offices responsible for oversight or administration of ADS- B implementation by DOD as part of the NextGen program. Our review also included Airlines for America, as it represented a significant portion of the civil aviation industry in negotiations with FAA on ADS-B implementation. Table 3 contains a list of the organizations and offices we contacted during the course of our review. To assess the extent to which DOD and FAA have identified security and operations risks and approved solutions to address these risks to military aircraft equipped with ADS-B Out technology, we reviewed policies, procedures, guidance, assessments, and other relevant documents from DOD, FAA, and NORAD that address ADS-B Out implementation, acquisition, operations, and cybersecurity risk management and mitigation, and any other issues that might be pertinent to identifying and addressing operations and security risks resulting from ADS-B Out. We also reviewed publicly available literature discussing potential ADS-B Out cybersecurity vulnerabilities. Specifically, we conducted a literature review of work related to vulnerabilities in ADS-B technology. To identify studies that potentially highlighted vulnerabilities that we could discuss with agency officials, we conducted key-word searches of government and private databases to identify public, private, academic, and other professional research related to ADS-B vulnerabilities. The government databases we searched included those of GAO, the Congressional Research Service, the Congressional Budget Office, and agency Inspectors General. The private databases searched include Web of Science, ProQuest, and ProQuest Professional. To determine relevance to our review, we assessed whether article subjects were related to vulnerabilities or vulnerability mitigations for ADS-B systems. We reviewed those studies cited in our report and found their methodologies to be sufficient. To further address our objective, we interviewed officials from NORAD, DOD, the military services, and FAA on potential risks, vulnerabilities, and mitigation strategies. We did not conduct independent security and vulnerability assessments of ADS-B technology to corroborate or validate security risks identified by NORAD, DOD, FAA, and others. While military aircraft and existing radar systems may be equipped with devices (including Mode S transponders) that could also pose security risks, this report focused on risks and potential solutions associated with ADS-B Out technology that FAA mandated DOD to install on its aircraft by January 1, 2020. We also visited multiple public websites to understand the extent to which the public could track current military flights over the United States. We met with a representative from one of these websites to understand the underlying sources of information and how the information was used to compile the images. To understand DOD and FAA coordination, we reviewed laws, guidance, and directives related to agency cooperation for the NextGen system and implementation of ADS-B technology. This included the 2010 FAA Federal Register entry that provided guidelines and requirements for coordination between agencies and the 2007 Deputy Secretary of Defense memorandum on implementing NextGen, which states that DOD components must develop cohesive plans and policies. To assess the extent to which DOD has implemented key tasks in the 2007 Deputy Secretary of Defense memorandum on implementing NextGen, we reviewed the Deputy Secretary of Defense’s 2007 NextGen memorandum and identified 20 tasks that were directed by the Deputy Secretary for the purpose of ensuring that NextGen meets DOD requirements, and that DOD’s resources are appropriately focused and managed. We focused on the 8 tasks wherein the accomplishment of the task would be significant to the development of plans and policies related to the implementation of the FAA’s ADS-B Out technology requirement. To evaluate the implementation status of these 8 tasks, we collected relevant documentation, interviewed officials from DOD, and reviewed this information. Initially, two analysts separately reviewed this information to determine whether each of the 8 tasks was implemented or not implemented. Later, a panel of four analysts collectively reviewed both sets of analyses completed for each task and determined whether a task would be better categorized as partially implemented, instead of implemented, or as not implemented. We conducted this performance audit from June 2016 to January 2018, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Department of Defense This report (GAO-18-177) is an unclassified version of GAO-18-176C—which had report number GAO-17-509C at the time it was transmitted to DOD for comment. Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Tommy Baril (Assistant Director), Tracy Barnes, David Beardwood, Virginia Chanley, Benjamin Emmel, Kevin Newak, Joshua Ormond, Matthew Sakrekoff, Amanda Weldon, and Edwin Yuen made major contributions to this report. Colleen Candrl, Mark Canter, Raj Chitikila, Tracy Harris, Kirk Kiester, Amie Lesser, Nicholas Marinos, Madhav Panwar, John Shumann, James Tallon, and Cheryl Weissman also made contributions to this report. Related GAO Products Next Generation Air Transportation System: Improved Risk Analysis Could Strengthen FAA’s Global Interoperability Efforts. GAO-15-608. Washington, D.C.: July 29, 2015 Air Traffic Control: FAA Needs a More Comprehensive Approach to Address Cybersecurity As Agency Transitions to NextGen. GAO-15-370. Washington D.C.: April 14, 2015. National Airspace System: Improved Budgeting Could Help FAA Better Determine Future Operations and Maintenance Priorities. GAO-13-693. Washington, D.C.: August 22, 2013. NextGen Air Transportation System: FAA Has Made Some Progress in Midterm Implementation, but Ongoing Challenges Limit Expected Benefits, GAO-13-264. Washington D.C.: April 8, 2013. Next Generation Air Transportation System: FAA Faces Implementation Challenges. GAO-12-1011T. Washington, D.C.: September 12, 2012. Next Generation Air Transportation: Collaborative Efforts with European Union Generally Mirror Effective Practices, but Near-Term Challenges Could Delay Implementation, GAO-12-48. Washington, D.C.: November 3, 2011.
target: DOD has until January 1, 2020, to equip its aircraft with ADS-B Out technology that would provide DOD, FAA, and private citizens the ability to track their flights in real-time and track flight patterns over time. This technology is a component of NextGen, a broader FAA initiative that seeks to modernize the current radar-driven, ground-based air transportation system into a satellite-driven space-based system. Senate Report 114-255 included a provision for GAO to assess the national defense implications of FAA's implementation of ADS-B. This report assesses the extent to which (1) DOD and FAA have identified operations and security risks and approved solutions to address these risks to ADS-B Out -equipped military aircraft; and (2) DOD has implemented key tasks in the 2007 memorandum on implementing NextGen. GAO analyzed risks identified by DOD and FAA related to ADS-B vulnerabilities, and how they could affect current and future air defense and air traffic missions. GAO also reviewed the tasks in the 2007 NextGen Memorandum and assessed whether the eight tasks specifically related to ADS-B were implemented. Since 2008, the Department of Defense (DOD) and the Department of Transportation's Federal Aviation Administration (FAA) have identified a variety of risks related to Automatic Dependent Surveillance-Broadcast (ADS-B) Out technology that could adversely affect DOD security and missions. However, they have not approved any solutions to address these risks. Compared with other tracking technology, ADS-B Out provides more information, such as an aircraft's precise location, velocity, and airframe dimensions, and better enables real-time and historical flight tracking. Individuals—including adversaries—could track military aircraft equipped with ADS-B Out technology, presenting risks to physical security and operations. This readily available public information allowed GAO to track various kinds of military aircraft. ADS-B Out is also vulnerable to electronic warfare and cyber-attacks. Since FAA is planning to divest radars as part of ADS-B implementation, homeland defense could also be at risk, since the North American Aerospace Defense Command relies on information from FAA radars to monitor air traffic. DOD and FAA have drafted a memorandum of agreement that focuses on equipping aircraft with ADS-B Out but does not address specific security risks. Unless DOD and FAA focus on these risks and approve one or more solutions in a timely manner, they may not have time to plan and execute actions that may be needed before January 1, 2020—when all aircraft are required to be equipped with ADS-B Out technology. Of the eight tasks associated with the implementation of ADS-B Out technology in the 2007 DOD NextGen memorandum—issued by the Deputy Secretary of Defense to ensure that the NextGen vision for the future national airspace system met DOD's requirements and the appropriate management of DOD's resources—DOD has implemented two, has partially implemented four, and has not implemented two. DOD has established a joint program office and identified a lead service, but it has only partially validated ADS-B Out requirements, developed a directive, issued an implementation plan, and incorporated NextGen into the planning, budgeting, and programming process. DOD has not taken significant action to integrate the needs and requirements of DOD components related to ADS-B into cohesive plans and policies for inclusion in NextGen joint planning and development, and has not provided periodic and recurring NextGen progress reports to the Deputy Secretary of Defense. As a result of DOD not fully implementing the 2007 NextGen memorandum, DOD components have lacked direction and cohesion while trying to address FAA's requirement to equip military aircraft. This is a public version of a classified report GAO issued in January 2018.