I’ve been talking about the potential risks of an adversary gaining access to your UAV telemetry data for quite some time. People are most concerned about their sensor data, the actual imagery or chemical levels or whatever the sensor is collecting. Yes, this is very valuable data but it is relatively easy to determine if it is being exfiltrated surreptitiously due to the bandwidth required to move it, and due to the fact that the normal logging mechanisms generally do not make it accessible to the vendor’s application or on board flight systems.
“The DJI Go App does store image thumbnails in its logs. You knew that, right?”
During these conversations I often point out that the telemetry information may pose a greater risk. Why?
- It is much more compact. The launch point alone reveals a lot of information and it, plus the time stamp, will fit in three floating point numbers.
- The location where you are flying says “There is something interesting here.” The more often you fly, the more interesting it is to you, and thus to an adversary.
- How you are flying tells an adversary something about what you are interested in:
If you are doing lawnmower tracks at 100m twice a day, you are performing some sort of change detection task, perhaps crop health or stockpile monitoring or building construction.
If you are flying a semi-random profile that often ends in an abrupt termination of control or of the flight, you may be testing counter UAS systems.
Pattern Analysis on CUAS test flights
So, let’s consider that last point. Test flights against counter UAS systems will likely:
- Take place at the same facility on more than one occasion but usually in clusters
- Generally start from a variety of points but fly towards a small number of points
- Almost always terminate away from where they started
- Often terminate in an unexpected manner
Using just the telemetry from the UAV or from the GCS application you can determine a set of characteristics that indicate that a particular flight represents a counter UAS test flight and set up an automated search for that pattern.
Each time you get a hit, you know that a counter UAS test was done and, in combination with other collected data, you may be able to start determining which CUAS systems are being tested and how effective they are.
Kind of useful information, I think. I used counter UAS systems as an example, but this type of analysis can be performed to identify many other sorts of UAS activity.
Pattern analysis in similar fields
And here is a concrete example of this type of analysis at work, shedding light on flight operations that U.S. agencies would prefer not be discussed in public. “… BuzzFeed News trained a computer to find [surveillance aircraft] by letting a machine-learning algorithm sift for planes with flight patterns that resembled those operated by the FBI and the Department of Homeland Security.”
Now, think about how many companies we share telemetry with. Not just the vendor but with UAV flight management and cloud based mapping services among others.
Should you be worried? In most cases, probably not. Some quick questions should help you decide.
Does anyone really care about your project?
If you are flying for normal crop health analysis:a) using that data to play financial markets or develop a competitive advantage would be hard and, b) a nation state could get the same data in a much larger volume using satellites. But, if you’re working on some proprietary seed that will eliminate famine then you might want to be more careful.
Do you know what data you are collecting (sensor and telemetry, generally), where it is stored, where it is transmitted, and how it is protected while at rest and in motion?
If you are doing all of the processing yourself and if you wipe all telemetry information prior to connecting to the vendor’s servers, you’re going a long way towards protecting your data. If you are processing your data with a third party, then you need to trust them so spend some time talking with them to understand why you should trust them.
In closing, two key points to keep in mind. Revealing where, when, and how you fly may pose a risk similar to revealing the actual sensor data. Know your data, where it is, where it goes, and how it is protected.
Note – I wrote an entire post without mentioning DJI. Why is that relevant? Because your telemetry data is valuable no matter what vendor you are using, and vulnerable even if you don’t share it with the vendor. This isn’t about DJI, it is about protecting your data and operations from adversaries be they nation states or local competitors.
From the DroneSec team…
For some context around the current DJI situation, hop on over to DroneLife for a great summary and explanatory read.
Jacob Tewes picked up this article for DroneSec after seeing David’s post – a very interesting take on the results telemetry data can show. The concept isn’t unfounded, with parallel examples in other industries showing what can be achieved with pattern analysis using captured system data. Really understanding the different elements on coordinate/flight path data could in fact help determine a great deal about the flight, the operator and the environment involved.
Further to that, at DroneSec we’re quite vendor agnostic. While its common to see the finger get pointed at DJI right now (and within reason), as David mentioned it’s important to take these drone security considerations under any manufacturer; regardless of country origin or reputation. Just last week, the Australian Transport Safety Buruea received their Piloted Aircraft Operator’s Certificate (RAOC) through the Civil Aviation Safety Authority (CASA). Their aim – to use thje drones to gather data and evidence during on-site investigations. Their choice of drone? The DJI Phantom 4. Already, the drone has captured footage of a loaded coal train that derailed in Queensland on the 21st of July.
Get in touch with David.
David founded the practice of UAV forensics in 2015, and is the founder of Kovar & Associates where he leads the development of Unmanned & Robotics Systems Analysis URSA is a suite of tools designed to collect, integrate, analyze, and present UAV related data for fleet management, criminal investigations, failure analysis, and predictive analysis. If you enjoyed this article and would like to get in touch with David, please contact him via LinkedIn, Twitter or email at: firstname.lastname@example.org.