## 2 Overview of Cyber Threats in EM
### Vehicular Technologies
#### 2.4.2 Unmanned Vehicles  
Unmanned Aerial Systems (UAS) have already started being used for civilian purposes, including law enforcement and emergency response, as they can provide aerial imagery of high resolution that enhances situational awareness and coordination. However, the security of unmanned aerial vehicles (UAVs) has been repeatedly breached in high-profile incidents in the past. In 2009, militants in Iraq used cheap off-the-shelf software to intercept live video feeds from US Predator drones and in 2011 a virus infected a number of US Predator and Reaper UAV drones, logging the keystrokes of the pilots who remotely controlled them [115]. The same year, Iranian TV showed a US RQ-170 Sentinel drone claiming that it had been electronically hijacked and landed by the Iranian army's electronic warfare unit [116]. According to [105], this was achieved by spoofing the GPS signals to the drone and then tricking it into landing in Iran rather than Afghanistan. The drone reported that it was landing at its home base. It is important to note that as UAVs are sizeable objects, if hijacked and deliberately crashed into a crowd or other target, they could cause considerable physical damage themselves.  
The elevated significance of UAV hijacking in the defence sector has sparked research in UAV cyber security. Most notably, a research team in Purdue University has created a simulation testbed that models UAV control systems and flight operations. Their current primary focus is on vulnerabilities of the autopilot systems. Up to now, they have confirmed that GPS spoofing can lead a UAV astray and in manner that may not be detected by the legitimate operator. In addition, they have analysed a gain-scheduling attack affecting the vehicle's controls and stability through sensor spoofing, and a fuzzing attack where the attacker injects random inputs to the vehicle's actuators [117]. In parallel, a less technical high-level analysis of the potential impact of cyber attacks on UAVs has been presented in [118]. It is important to note that a recent congressional report on unmanned aircraft systems has stated that vulnerabilities in the command and control of UAS operations are a primary obstacle to their integration in the national airspace system [119].  
Land vehicles that operate in an autonomous or semi-autonomous remotely-controlled manner are also increasingly proposed and trialled for EM. Such vehicles can reach areas often inaccessible to first responders and even set up an ad hoc communication infrastructure [120]. However, unmanned vehicles are typically not designed with information security in mind and are vulnerable to multiple types of attacks affecting the collection or communication of critical information. An excellent survey of these cyber threats has been presented in [121].  
_Open issues in Vehicular Technologies used in EM_: While we do not consider the vulnerabilities of embedded vehicular systems or web-based immobilisation systems to be an imminent cause for concern in EM, threats from other supporting technologies, such as satellite navigation systems, could have a more serious and direct impact. Potential manipulation of satellite navigation signals (Section 2.2.1) could affect EM by creating local congestion so as to maximise the number of civilians affected by a terrorist attack or to delay ambulances and fire engines, and such attacks have already been shown to affect UAVs. While research in anti-spoofing mechanisms for satellite navigation has been carried out (Section 2.2.1), these are unlikely to be implemented in real world systems very soon. Thus, the impact that cyber-initiated traffic congestion or UAS hijacking would have in an emergency needs to be analysed.