Thoughts on FAA Reauthorization Act of 2024 and Data Privacy

By Jack Sweeney

The recent H.R. 3935 "FAA Reauthorization Act of 2024," which was signed into law, contains some measures that are supposed to enhance privacy.

The bill contains section "SEC. 803. Data Privacy" with two main sections.

In the data privacy section, subsections A and B require the FAA to establish procedures that allow an aircraft owner to request their ownership info obscured or removed from "broad dissemination or display by the FAA." A Freedom of Information Act (FOIA) request is not broad dissemination, so technically, if you FOIA request ownership of an aircraft, you will still have this information, but take this as you will. Not to mention that other sources of this data exist not via registry or not via FAA.

This move of enabling owners to hide ownership already exists, just not via the FAA. Did it solve the problem in the past? No, not really. 

Most people don't search the entire FAA aircraft registry when searching for an aircraft owned by someone notable. We use the media and associated sources, so hiding the ownership details will not fix this privacy issue.

I've become aware that law enforcement agencies have failed to identify aircraft registration before because of blocking techniques previously put in place. One such event occurred because a plane used the Privacy International Civil Aviation Organization (ICAO) Address (PIA) to hide its identity. The agency was not aware of what PIA was. No good tool exists for law enforcement agencies that allows them to see this associated jet tracking data and ownership data while these privacy programs are implemented. These privacy programs being incorporated for private aviation are being implemented to reduce law enforcement's efficiency in identifying bad actors.

Subsection C of data privacy requires the FAA to establish a program that allows aircraft owners to apply for a new ICAO code for the aircraft (transponder code). Aircraft owners must attest to the FAA's safety or security risk when applying for a new ICAO code. If the aircraft owner is given a new ICAO code, the aircraft owner must also update their N-number (the registration/tail number, including the physical markings on the aircraft). This ICAO or transponder code change is a one-time event, it is not the same as the existing PIA program, and it's a worse solution.

Using these two new provisions that will be put in place by the FAA, let's talk about a what-if scenario, so let's assume someone is approved for a new ICAO code and associated N-number. The person also requests that for this new N-number, their personal details be hidden from the public by the FAA. However, the aircraft, when turned off before the new N-number and ICAO code were applied, was still broadcasting its exact GPS location thanks to automatic dependent surveillance-Broadcast (ADS-B). The aircraft's new N-number and ICAO code are installed. The aircraft powers up with its new ICAO code, but at the same coordinates where it previously powered off, revealing it is likely the same aircraft.

LADD was the first blocking program put in place by the FAA. Aircraft owners request the FAA that their aircraft be added to the LADD blocking list. Users of FAA data sign an agreement to block aircraft present on the LADD list. The problem is that aircraft still have ADS-B out; individuals not using FAA (live) data are not required to block aircraft present on the block list. ADS-B can be collected via the radio signals straight out of the air.

The second program, PIA, is more so of a cloaking program than a blocking program, enhancing privacy with ADS-B. This program allows aircraft owners to use an ICAO code not linked to their N-number. This program has many hurdles to proper use and is flawed. This program is meant to fix the flaws in the LADD program.

PIA can be proven ineffective, like the new legislation, where an aircraft changes its ICAO/tail number. With PIA, an aircraft powers down in X location, changes the PIA code, and powers up in the same X location, we know it's probably the same aircraft due to location and characteristics.

First, this bill does not prevent ADS-B tracking, and every aircraft must still have a transponder to share telemetry and identity. The only proper solution to solving privacy in the ADS-B era where we can track any aircraft is reducing access to ADS-B or encrypting ADS-B, which is questionable in many aspects, technologically, costs, and ethically. 

The associated ADS-B technology in aircraft and ground stations must be upgraded to support a new ADS-B standard that supports encryption. Would it be worth the cost when one in six flights in the U.S. is private, especially when private aviation only contributes to two percent of taxes that fund the FAA? Is it proper for this information to be encrypted at all? 

Perhaps we want to see what aircraft are flying overhead. One of the earlier drafts of H.R. 3935 had a section that would require the FAA to do a study on ADS-B encryption, but it was removed before the bill was passed. The problem also cannot be solved by just the FAA. ADS-B is a global standard required by many countries, and cooperation is required by the ICAO.

Just because an owner can hide their information from the FAA registry, making it "private," does not make it illegal to track these jets. I have been advised that we don't have laws against using public information to conclude who owns what.

Dan Hubbard, senior vice president of communications for the National Business Aviation Association (NBAA), [told Bloomberg] that the new bill renews "protections from questionable flight-stalking methods while ensuring that law-enforcement agencies, security officials, air traffic managers, and other appropriate parties" have the necessary information about all aircraft. 

This is simply not true, as previously mentioned. It is putting the private aviation industry before law enforcement. Privacy measures are being implemented without thinking about how this makes it more difficult for law enforcement. If privacy measures are implemented with tools for law enforcement to access data easily, this would be OK, but this is not the case. 

Hubbard also said, "A person shouldn't be required to surrender their right to privacy and safety just because they board an aircraft." A person has never surrendered their privacy when they board an aircraft. We aren't tracking flight manifests with the passenger list. We are tracking the jet regardless of who's on it.

We see tool after tool and measure after measure to fix this problem, not the problem at hand. First was the FAA BARR (Block Aircraft Registration Request) in 2000. Then, BARR was revised to LADD in 2019 and PIA in 2019. If you ask anyone in the aviation industry, you will know that the FAA struggles with information technology and staying up to date with technology. An excellent example of this is when you make a FOIA request to the FAA, and it  sends a disc to you in the mail. What is this—1998 Netflix? Congress is implementing measures here that will have unintended consequences, just like when ADS-B was implemented. It ended up creating this very privacy problem.

Currently, all my aircraft identification is done manually with me and members of the flight tracking community. As of now, I use no AI in any of my processes. But, AI could analyze aircraft's flight patterns, altitudes, speeds, and other operational characteristics. By comparing these patterns with historical data, it could infer the identity of aircraft despite the use of temporary ICAO addresses. 

Neural networks could correlate data from multiple sources, such as airport departures and arrivals, known flight schedules, the media and other publicly available information, to identify aircraft. Sophisticated machine learning models could be trained on large datasets of flight information, learning to recognize subtle cues and patterns unique to specific aircraft or operators. 

PIA has downsides, and required upkeep causes the program to hinder its adoption, which reduces its effectiveness. The reduced effectiveness of PIA and other blocking programs allows for a future where using the mentioned methods makes identifying aircraft of interest possible.

Jack Sweeney is a programmer and flight-tracking enthusiast who is known for creating automated bots that track celebrities' private jets, such as Elon Musk and Taylor Swift.