4 ms·

There’s a randomization aspect to it to thwart that. The specs haven’t been finalized, but they’ve been given to ASTM to flesh out. The Federal Aviation Regulat

by teeray 5y ago

There’s a randomization aspect to it to thwart that. The specs haven’t been finalized, but they’ve been given to ASTM to flesh out. The Federal Aviation Regulation basically spells out the requirements at this point. I believe this is a draft [0] (it could be final too at this point). From there, here’s the specific ID randomization: > UTM (UUID): A UTM-provided unique ID traceable to the Registration ID that can act like a “session id” to protect exposure of operationally sensitive information. [0] https://www.reginfo.gov/public/do/eoDownloadDocument?pubId=&eodoc=true&documentID=7280 https://www.reginfo.gov/public/do/eoDownloadDocument?pubId=&...

dredmorbius 5y ago
So long as the identifier is constant over time that does not matter. From your reference: UAS ID Type 1. Serial Number, 2. Registration ID, or 3. UTM U (page 10) That is: there is a single identifier, constant over time, that is assigned to each drone aircraft. The UUID standard appears to be RFC 4122: https://www.rfc-editor.org/rfc/rfc4122 https://www.rfc-editor.org/rfc/rfc4122 And again: so long as that's transmitted in the clear, ANY party may accumulate a database of UUIDs and locations over time, which would tend to identify the party(ies) associated with a specific drone. That might not be precisely the operator, but if drone ID "8daf5e654951a033175fb71e0a2ecc03"[1] keeps showing up at Your Fine City's Police Department ... or sewage department, or electric utility ... you might begin to draw some inferences regarding its likely owner/operator. It might be easier to do so if the identifier had, say, a specific entity element to it (say, as with LDAP or X.500 entity attributes), but the lack of such an element to the identifier itself is at best a small hinderance to owner/operator identification. ________________________________ Notes: 1. md5sum of the randomly-selected string "random drone id"
- cmeacham98 5y ago
  Is this an attack we care about preventing? You can do the same with license plates, for example.
  - Breza 5y ago
    I really don't mind if people can trace my drone back to me. I'm a licensed ham radio operator and my call sign is linked to my real identity. And I want to know who is flying drones over my property. The two police departments that regularly fly helos over my house use the same paint scheme as their squad cars to make it obvious who they are. They use the tail numbers N911DC (Washington DC) and N911PG (Prince George's County) for the same reason.
  - dredmorbius 5y ago
    It's been a question of interest within this thread. https://news.ycombinator.com/item?id=30923274 https://news.ycombinator.com/item?id=30923274
- teeray 5y ago
  There’s a diversity of allowed identifiers to support different hardware. The fixed identifiers are intended for retrofit modules, since they need to have as little impact on the drone’s center of gravity as possible. Newer hardware will likely incorporate it into the receiver’s functionality.
  - dredmorbius 5y ago
    You've made no credible representation that identifiers will be time-variable in a non-predictable manner. Which is required to defeat any level of time-based observational collection and correlation by third parties. As is commonly the place with present aviation tracking systems.
    - Breza 5y ago
      Shouldn't the public know who's flying drones over their property? I wish the drone IDs were publicly listed, just like N numbers.
lupire 5y ago
Why does anyone think they deserve a right to privacy for their aircraft in flight? That is a ridiculous invasion of public space.
- teeray 5y ago
  There is a reason you can’t just plug in anyone’s vehicle license plate and get their name and address.
  - Breza 5y ago
    You also can't drive your car onto my property without permission. There are valid reasons for a drone to do exactly that, and I'd like to know who is looking at my house. It would be nice to Google a drone ID and realize that it's just the power company looking for branches that might take down a power line.
  - dredmorbius 5y ago
    The information is widely, if not (yet) universally, available. https://www.eff.org/pages/automated-license-plate-readers-alpr https://www.eff.org/pages/automated-license-plate-readers-al...
    - Teever 5y ago
      Sounds like we need to fix that with regulation too?
      - dredmorbius 5y ago
        I'd be on board with that.
    - ILMostro7 5y ago
      that's not quite the same thing, as it doesn't provide "name and adress", no?
      - 5y ago

by teeray 5y ago

dredmorbius 5y ago

So long as the identifier is constant over time that does not matter. From your reference: UAS ID Type 1. Serial Number, 2. Registration ID, or 3. UTM U (page 10) That is: there is a single identifier, constant over time, that is assigned to each drone aircraft. The UUID standard appears to be RFC 4122: https://www.rfc-editor.org/rfc/rfc4122 https://www.rfc-editor.org/rfc/rfc4122 And again: so long as that's transmitted in the clear, ANY party may accumulate a database of UUIDs and locations over time, which would tend to identify the party(ies) associated with a specific drone. That might not be precisely the operator, but if drone ID "8daf5e654951a033175fb71e0a2ecc03"[1] keeps showing up at Your Fine City's Police Department ... or sewage department, or electric utility ... you might begin to draw some inferences regarding its likely owner/operator. It might be easier to do so if the identifier had, say, a specific entity element to it (say, as with LDAP or X.500 entity attributes), but the lack of such an element to the identifier itself is at best a small hinderance to owner/operator identification. ________________________________ Notes: 1. md5sum of the randomly-selected string "random drone id"

cmeacham98 5y ago
Is this an attack we care about preventing? You can do the same with license plates, for example.
- Breza 5y ago
  I really don't mind if people can trace my drone back to me. I'm a licensed ham radio operator and my call sign is linked to my real identity. And I want to know who is flying drones over my property. The two police departments that regularly fly helos over my house use the same paint scheme as their squad cars to make it obvious who they are. They use the tail numbers N911DC (Washington DC) and N911PG (Prince George's County) for the same reason.
- dredmorbius 5y ago
  It's been a question of interest within this thread. https://news.ycombinator.com/item?id=30923274 https://news.ycombinator.com/item?id=30923274
teeray 5y ago
There’s a diversity of allowed identifiers to support different hardware. The fixed identifiers are intended for retrofit modules, since they need to have as little impact on the drone’s center of gravity as possible. Newer hardware will likely incorporate it into the receiver’s functionality.
- dredmorbius 5y ago
  You've made no credible representation that identifiers will be time-variable in a non-predictable manner. Which is required to defeat any level of time-based observational collection and correlation by third parties. As is commonly the place with present aviation tracking systems.
  - Breza 5y ago
    Shouldn't the public know who's flying drones over their property? I wish the drone IDs were publicly listed, just like N numbers.

lupire 5y ago

Why does anyone think they deserve a right to privacy for their aircraft in flight? That is a ridiculous invasion of public space.

teeray 5y ago
There is a reason you can’t just plug in anyone’s vehicle license plate and get their name and address.
- Breza 5y ago
  You also can't drive your car onto my property without permission. There are valid reasons for a drone to do exactly that, and I'd like to know who is looking at my house. It would be nice to Google a drone ID and realize that it's just the power company looking for branches that might take down a power line.
- dredmorbius 5y ago
  The information is widely, if not (yet) universally, available. https://www.eff.org/pages/automated-license-plate-readers-alpr https://www.eff.org/pages/automated-license-plate-readers-al...
  - Teever 5y ago
    Sounds like we need to fix that with regulation too?
    - dredmorbius 5y ago
      I'd be on board with that.
  - ILMostro7 5y ago
    that's not quite the same thing, as it doesn't provide "name and adress", no?
    - 5y ago