Last year I posted a bit regarding ads-b privacy. Specifically:

https://backcountrypilot.org/forum/adsb ... 00#p330657

There is anonymous mode, kinda.... It's hard to explain:

In order to use anonymous mode, you must be using 978UAT. That piggybacks onto your 1090mhz transponder. So your 1090 sends out your squawk code, and the 978UAT box sends out your position information.

In order to go into anonymous mode, your 978UAT box needs to know for sure you are squawking 1200, but it doesn't know that until your transponder gets hit and see's it report 1200. That usually happens after the 978UAT box gets a GPS signal, which as soon as it does, it must send your position according to the FAA.

So your system will probably send out one or two position reports on 978mhz before your transponder warms up, gets hit, then it switches to anonymous mode.

From the FAA side, it's fairly easy to see that an airplane at this location going this direction at this speed suddenly stopped sending it's ICAO code and a new anonymous airplane is actually the same airplane.

The only way around this is to run the echoUAT box. That box can talk to your transponder over a serial interface and can verify you are squawking 1200 before the GPS lock. In that case, you can always be anonymous and still comply with the rules.

Clear as mud?

I also posted:

I guarantee you that anonymous mode does hide your ID, it's just that the current systems on the market start out in non-anonymous mode for a minute or so before going to anonymous mode, and it's easy for the FAA to relate the two together.

The reason I can guarantee this is because the UAT data is not encrypted, and a simple software radio and decoder can show you the actual bits leaving the ads-b box. It's easy to debug this stuff and see what is actually going on at a packet level, and the packets don't lie. If your ICAO code is not being broadcast, the FAA can't see it.

See my note above which describes how to actually get anonymous mode.

I also wrote:

That tells me that the Garmin GDL-82 and echoUAT are the only solutions that are truly anonymous. The Garmin because it interrogates the transponder to verify VFR squawk, and the echoUAT because it can verify VFR squawk over serial.

I even made a graphic:



Uavionix also confirmed:

https://backcountrypilot.org/forum/uavi ... 08#p331218

I posted all of this because privacy is important to me, and because there are a lot of pilots out there with their head in the ipad and it makes sense to be seen by both those with their head in and outside of the cockpit.

Now that I have an updated GDL-82 mounted in my airplane, I am now able to personally and fully verify exactly what it's doing. Using an SDR receiver and dump978 I was able to record this raw data in regard to my aircraft:

-0931e9d900000000000005508000000900066a0025ed2d0bd600c020000000000000;
-0931e9d900000000000005508000000a30066a0025ed2d0b2a00c020000000000000;
-0931e9d900000000000005508000000900066a0025ed2d0b9e00c020000000000000;
-0931e9d900000000000005508000000a30066a0025ed2d0bf200c020000000000000;
-0931e9d900000000000005508000000900066a0025ed2d0b6600c020000000000000;
-0931e9d900000000000005508000000a30066a0025ed2d0bba00c020000000000000;
-0131e9d90000000000000550800000090000;
-0931e9d900000000000005508000000a300b27ae84e6c40b8200c220000000000000;
-0931e9d900000000000005508000000900066a0025ed2d0bf600c020000000000000;
-0131e9d900000000000005508000000a3000;
<and so on>

That decodes to:

HDR:
MDB Type: 1
Address: 31E9D9 (reserved (national use))
SV:
NIC: 0
Altitude: 1100 ft (barometric)
Dimensions: 25.0m L x 23.0m W
UTC coupling: no
TIS-B site ID: 0
MS:
Emitter category: Light <= 7000kg
Callsign: squawk 1200
Emergency status: No emergency
UAT version: 2
SIL: 3
Transmit MSO: 53
NACp: 0
NACv: 0
NICbaro: 0
Capabilities: CDTI ACAS
Active modes:
Target track type: true heading
AUXSV:
Sec. altitude: unavailable

HDR:
MDB Type: 0
Address: 31E9D9 (reserved (national use))
SV:
NIC: 0
Altitude: 1100 ft (barometric)
Dimensions: 25.0m L x 23.0m W
UTC coupling: no
TIS-B site ID: 0

and so on......

As you can see my true ICAO code is not in any of the transmitted data. This is truly anonymous.

I also tested with two different skybeacon installs on the ground and as expected the unit spit out the actual ICAO code a few times before going anonymous. I'm not going to post that data because it does have actual tail numbers and the airplanes tested were not mine.

I know there will still be those that insist the FAA knows everything you are doing with ads-b, but decoding the actual radio signals shows that that is not the case.

Anyway, I hope that this information helps someone that is on the fence and worried about privacy.

Thanks for that info. So how does it work if you transmit actual data for a bit first? Can so done go back amd find the tail #? Do class C airports allow you guys to fly out with a 1200 code? Most class D here in Canada gives us other codes, but I've never asked if I can just use 1200.

Strong work. Thank you for sharing.

A1Skinner wrote:Thanks for that info. So how does it work if you transmit actual data for a bit first? Can so done go back amd find the tail #? Do class C airports allow you guys to fly out with a 1200 code? Most class D here in Canada gives us other codes, but I've never asked if I can just use 1200.

The flight ID doesn't change and it's easy to see that an aircraft at a certain location disappeared and a new anonymous one appeared. Relating the data together isn't hard.

When you fly into towered airspace they may give you a squawk code. Once you put that in, you aren't anonymous anymore.

schu

I just found this map of where the towers are:

http://towers.stratux.me/

Looking at the map tells me a lot about how anonymous systems like a skybeacon will be. If you started up in Yakima and didn't immediately get interrogated, then you might leak out a few ICAO broadcasts that the tower can see and record.

Where I'm at over in Wenatchee, there just isn't a tower close enough to pick me up until I get super high. Further, all of the flightaware sites in this area are configured to work on 1090mhz:

https://flightaware.com/adsb/coverage

I suspect most 978mhz stuff is anonymous in Wenatchee regardless of mode just because nobody listening.

I'll have to fly towards Yakima or Moses Lake before I can even validate my install.

akschu wrote:I just found this map of where the towers are:

http://towers.stratux.me/

Looking at the map tells me a lot about how anonymous systems like a skybeacon will be. If you started up in Yakima and didn't immediately get interrogated, then you might leak out a few ICAO broadcasts that the tower can see and record.

Where I'm at over in Wenatchee, there just isn't a tower close enough to pick me up until I get super high. Further, all of the flightaware sites in this area are configured to work on 1090mhz:

https://flightaware.com/adsb/coverage

I suspect most 978mhz stuff is anonymous in Wenatchee regardless of mode just because nobody listening.

I'll have to fly towards Yakima or Moses Lake before I can even validate my install.

This is a map of the towers that broadcast. In addition, I was told that there are many more locations that just "Listen" for local broadcasts, There is one like that located at an airport near me and was shown it by airport manager. It just feeds the data back to the nearest ATC. So even though you may not be near a broadcasting tower, you still may be picked up locally.

Interesting. My question is how does the SkyBeacon transmit ID on startup, when it’s set to not transmit below 40 mph? It should be stabilized and such well before I get to that speed.

Not arguing, just trying to understand this “system” if you can call it that.

MTV

mtv wrote:Interesting. My question is how does the SkyBeacon transmit ID on startup, when it’s set to not transmit below 40 mph? It should be stabilized and such well before I get to that speed.

Not arguing, just trying to understand this “system” if you can call it that.

MTV

I think we are all trying to understand how this works, thankfully the FAA does one thing fairly well: document.

So looking at the skybeacon manual it says:

Vso (knots):
This parameter allows skyBeacon to
automatically switch between airborne and
ground modes and should be set to the
aircraft stall speed.

So this isn't turning it on or off, this is turning it between ground and airborne.

To see what that means we look here:

https://www.icao.int/safety/acp/Inactiv ... 0-1%20.pdf

That document describes the actual UAT protocol. This is important because without a protocol (rules governing transmission) we couldn't have two systems communicate with each other.

In that document under 3.2.1.5.2.5 we get:

“A/G STATE” Field Encoding
The Air/Ground State (“A/G STATE”) field is a 2-bit (bits 1 and 2 of byte 13) field that
indicates the format used for representing horizontal velocity. The value of this field
determines the encoding of the “HORIZONTAL VELOCITY” field. The “A/G STATE”
field is composed of two (2) 1-bit fields used as follows:
1. The Vertical Status bit (bit 1 of byte 13) is used to reflect the AIRBORNE or ONGROUND condition as determined in §3.2.1.5.2.5.1.

That's basically a lot of technical information that simply means that the ADS-b solution must be able to detect between ground and airborne states.

The information broadcasted changes based on that state.

Notice in my dump above there wasn't any lat/long/speed information. That's because I was in the ground state.

It is my understanding that regardless of the ground/airborne state, the rules regarding anonymous mode depending on a 1200 squawk are the same, thus, the skybeacon transmits the actual ICAO code even in ground mode as long as it can't verify the squawk code.

Here is the output from a skybeacon:

HDR:
MDB Type: 0
Address: AAXXXX (ICAO address via ADS-B)
SV:
NIC: 0
Altitude: 700 ft (barometric)
Dimensions: 25.0m L x 23.0m W
UTC coupling: no
TIS-B site ID: 0

HDR:
MDB Type: 2
Address: AAXXXX (ICAO address via ADS-B)
SV:
NIC: 0
Altitude: 700 ft (barometric)
Dimensions: 25.0m L x 23.0m W
UTC coupling: no
TIS-B site ID: 0
AUXSV:
Sec. altitude: unavailable

I changed the address from its original because a simple google search turns up the tail number of this airplane. Even without google the math to resolve the icao number is pretty simple as the ICAO number is sequentially assigned from A00001 for N1 to ADF669 for N999ZZ which is why many ads-b products now allow you to configure with your tail number and it sets your ICAO for you.

Anyway, sorry for the long post and the math, but from what I can dig up, this is how it actually works.

akschu wrote:

mtv wrote:Interesting. My question is how does the SkyBeacon transmit ID on startup, when it’s set to not transmit below 40 mph? It should be stabilized and such well before I get to that speed.

Not arguing, just trying to understand this “system” if you can call it that.

MTV

I think we are all trying to understand how this works, thankfully the FAA does one thing fairly well: document.

So looking at the skybeacon manual it says:

Vso (knots):
This parameter allows skyBeacon to
automatically switch between airborne and
ground modes and should be set to the
aircraft stall speed.

So this isn't turning it on or off, this is turning it between ground and airborne.

To see what that means we look here:

https://www.icao.int/safety/acp/Inactiv ... 0-1%20.pdf

That document describes the actual UAT protocol. This is important because without a protocol (rules governing transmission) we couldn't have two systems communicate with each other.

In that document under 3.2.1.5.2.5 we get:

“A/G STATE” Field Encoding
The Air/Ground State (“A/G STATE”) field is a 2-bit (bits 1 and 2 of byte 13) field that
indicates the format used for representing horizontal velocity. The value of this field
determines the encoding of the “HORIZONTAL VELOCITY” field. The “A/G STATE”
field is composed of two (2) 1-bit fields used as follows:
1. The Vertical Status bit (bit 1 of byte 13) is used to reflect the AIRBORNE or ONGROUND condition as determined in §3.2.1.5.2.5.1.

That's basically a lot of technical information that simply means that the ADS-b solution must be able to detect between ground and airborne states.

The information broadcasted changes based on that state.

Notice in my dump above there wasn't any lat/long/speed information. That's because I was in the ground state.

It is my understanding that regardless of the ground/airborne state, the rules regarding anonymous mode depending on a 1200 squawk are the same, thus, the skybeacon transmits the actual ICAO code even in ground mode as long as it can't verify the squawk code.

Here is the output from a skybeacon:

HDR:
MDB Type: 0
Address: AAXXXX (ICAO address via ADS-B)
SV:
NIC: 0
Altitude: 700 ft (barometric)
Dimensions: 25.0m L x 23.0m W
UTC coupling: no
TIS-B site ID: 0

HDR:
MDB Type: 2
Address: AAXXXX (ICAO address via ADS-B)
SV:
NIC: 0
Altitude: 700 ft (barometric)
Dimensions: 25.0m L x 23.0m W
UTC coupling: no
TIS-B site ID: 0
AUXSV:
Sec. altitude: unavailable

I changed the address from its original because a simple google search turns up the tail number of this airplane. Even without google the math to resolve the icao number is pretty simple as the ICAO number is sequentially assigned from A00001 for N1 to ADF669 for N999ZZ which is why many ads-b products now allow you to configure with your tail number and it sets your ICAO for you.

Anyway, sorry for the long post and the math, but from what I can dig up, this is how it actually works.

Not at all, thanks. That explains a lot. So, at least theoretically, if my SkyBeacon is in range of a GBT, it will initially transmit a valid ICAO number, even in anon. mode.

But what if I start up somewhere out of range of a GBT?

MTV

mtv wrote:Not at all, thanks. That explains a lot. So, at least theoretically, if my SkyBeacon is in range of a GBT, it will initially transmit a valid ICAO number, even in anon. mode.

But what if I start up somewhere out of range of a GBT?

MTV

It's a dance between a number of variables.

1. In order to be anonymous the skybeacon needs to see you squawking VFR, but it can't interrogate. So until there is an interrogation from some other source, it will spit out your ICAO.

2. If someone listens to your ICAO before you go anonymous, it's easy to relate the data together and know about the entire flight.

So, if you start up, and your transponder isn't immediately interrogated the skybeacon spits out your ICAO until it can confirm the status of your transponder. If you also happen to be near a GBT, then it could record your ICAO and track your flight even after you transition to anonymous.

Lets say there isn't any GBT near you (or a listening post as pouellette posted) and you get airborne and your transponder is getting hit, then the skybeacon will go anonymous before you are close enough to someone listening.

Here is the take away:

Systems that get the transponder information by listening on 1090mhz will leak your ICAO code until it sees your transponder in VFR mode. That leak may or may not reveal your tail number, it all depends on who is listening.

Systems that get the transponder information directly (gdl-82 over the antenna wire where it interrogates the transponder itself, or the echoUAT where it gets the squawk over a serial cable) will not leak your ICAO code, so it no longer matters where you are or if someone is listening.

In my neck of the woods, a skybeacon is pretty dang anonymous, nobody is listening (except me on my laptop playing with this stuff), but... if the flight aware people start tracking 978UAT, then anybody with $75 and some time can listen for your aircraft and relay it to flight aware.

One last point. The uavionix guy confirms this in his post. Perhaps the way he worded it will make more sense than my overly verbose communication style.

https://backcountrypilot.org/forum/uavi ... 08#p331218

Sure,

I don't love this answer, but it's Yes and No. Anonymous Mode starts with the confirmation of 1200 and pressure Altitude from your transponder. This is a requirement of the FAA at this time. If you are on the ground and get transponder interrogations from other aircraft or nearby radar, you'll be anonymous from ground up, but if you are not getting transponder interrogations and we can't sync the squawk or baro, then the first few pings will send your N number... which in most cases is out of range from ATC due to the transponder output power being higher than the UAT output. Additionally if you are using anonymous mode and get a unique squawk, we exit anonymous mode, until you return to VFR 1200. But keep in mind that your breadcrumb flight path does not stop and restart, the your ID is ties to that flight trail, report.

With EchoUAT in Experimental that is serial wired to the transponder or EFIS, it would be anonymous from the start all the time. EchoUAT is approved for LSA and EXP, but not Certified Aircraft.

I can tell you I've flown hundreds of flights in fringe radar and metro areas and the majority of the time I can't access a report if in anonymous mode. Also UAT ADS-B is the only way for Anonymous Mode, it is not permitted on Mode S or 1090ES.

I hope this helps.

It really doesn't matter if the actual ICAO address is transmitted on startup due to the way the "random" address is calculated. The "random" address is your real ICAO address XORed with 12 bits of the lat value and 12 bits of the lon value. As a result, anyone that receives the first packet you broadcast in anonymous mode can trivially calculate your actual ICAO address.

Furthermore, if you always turn the system on in the same location (such as just outside your hangar door), the "random" address will always be the same.

In short, there is no privacy if you have an ADS-B out system.

BKK wrote:It really doesn't matter if the actual ICAO address is transmitted on startup due to the way the "random" address is calculated. The "random" address is your real ICAO address XORed with 12 bits of the lat value and 12 bits of the lon value. As a result, anyone that receives the first packet you broadcast in anonymous mode can trivially calculate your actual ICAO address.

Furthermore, if you always turn the system on in the same location (such as just outside your hangar door), the "random" address will always be the same.

In short, there is no privacy if you have an ADS-B out system.

Thanks for the input. While it's true that the algorithm is deterministic, even moving a few feet from my hangar changes the (not so) random ICAO code and the 12LSB of my lat/long aren't broadcast until I'm moving faster than stall.

You make a great point that it's not really random, but you also point out that someone would need to know your exact startup location down to about 2 feet.

Thins is a very interesting thread. I have a tail beacon and after my validation flight, have been running in anonymous mode. Not that I care about privacy that much, but I like the feature. I’ve been flying all weekend. Can any of you tech savvy guys find my flights in the ways you describe? N63AK. Simply looking on flightaware type sites doesn’t bring anything up, how deep do you have to dig to find this stuff?

Thanks for the education, it’s very interesting. If


Edit: what brought this up today was that on my flight yesterday I had to reset my alternator so I flipped the master on/off (no split switch). I was curious if this made me fail a PAPR test, but I can’t get the PAPR system to find the flight. I was under the impression that anonymous mode was only “outside facing” and the FAA could always see you. Either way, just made me curious.

I saw a flight Feb 29 on flightaware of 102 mi.

a3holerman wrote:I saw a flight Feb 29 on flightaware of 102 mi.

Yes that was my validation flight. I flew in the same area yesterday and will again today. Thought i could be a decent test case as to the actual privacy allowed by anonymous mode on Tailbeacon

All great information, guys! Thanks for doing the research!

MTV

What does it transmit if you accidentally leave it in STBY? Asking for a friend.

asa wrote:Thins is a very interesting thread. I have a tail beacon and after my validation flight, have been running in anonymous mode. Not that I care about privacy that much, but I like the feature. I’ve been flying all weekend. Can any of you tech savvy guys find my flights in the ways you describe? N63AK. Simply looking on flightaware type sites doesn’t bring anything up, how deep do you have to dig to find this stuff?

Thanks for the education, it’s very interesting. If


Edit: what brought this up today was that on my flight yesterday I had to reset my alternator so I flipped the master on/off (no split switch). I was curious if this made me fail a PAPR test, but I can’t get the PAPR system to find the flight. I was under the impression that anonymous mode was only “outside facing” and the FAA could always see you. Either way, just made me curious.

In order to find your flight we need to either directly listen to the airwaves for your ads-b signal, or depend on some other system to listen for it as well as record it and make it searchable.

If you weren't in range of the FAA PAPR system nor the flightaware system, then you are anonymous to them, as nobody is listening, but, that doesn't change what your ads-b transmitter is actually broadcasting, which was really the point of this thread... what exactly is it spitting out...

Right now, I think most people are anonymous enough with a skybeacon as long as they don't live near an FAA ground station that listens for UAT (978mhz) signals, but, if you do live near one, you really aren't anonymous to the FAA. Further, most flightaware ground stations (basically nerdy people with a radio receiver and internet connection) only listen for 1090mhz ads-b which is the ads-b built in to a transponder, otherwise known as Mode ES, but I don't think it will stay that way forever. I think more will start listening on 978mhz.

Anyway, glad the thread clarified what the FAA can see and what they can't see, that was kind of the point.

aftCG wrote:What does it transmit if you accidentally leave it in STBY? Asking for a friend.

When the transponder is in standby? I think that the ads-b solution broadcasts your ICAO because as far as I understand it must transmit something if it's on, and if it can't see your transponder responding with 1200, it can't be in anonymous mod.

The only way to know for sure is to get a software defined radio dongle and dump978 and test yourself. If you have a stratux, it should tell you what it sees.

schu

Thanks Schu,

Any idea what the FAA sees when my tailbeacon is on and transponder off?