http://www.airsport-corp.com/adsb2.htm
Although it talks about using ADS-B to target a specific aircraft, the ILS spoofing segment is interesting. And, no, I don't believe in chemtrails...
ADS-B, Scenario Three: Revenge
"Thomas Whitten, Ph.D., is a brilliant scientist. He served honorably in the Army during VietNam, finished his education soon after, and has been working for a major pharmaceutical firm ever since. His career reached its peak when he developed the latest miracle drug which will ease suffering and save untold lives worldwide.
“I was a loyal employee” Tom said. “Many of my colleagues jumped from one firm to another, always at an increase in pay. I didn't. I stayed here year after year, decade fading into decade, because I truly believed in what I was doing. For the past 17 years I have been working on a single project, trying to unravel the relationship between DNA and this particular disease. It was rewarding when we made progress, it was discouraging when we didn't, and altogether too much time was wasted cajoling management to fund our work. Several times the project was almost canceled, and each time I managed to convince the executives that we should continue.
“And look at the company now. We were the stars of the latest mega-merger, the largest ever in the pharmaceutical arena. Our stockholders made billions, literally billions, because of my work. The CEO himself received a $14 Million bonus, other top management guys received millions more.
“And me? What do they give me? A nice little write-up in the company newsletter, that's what I got. I'm making $94k a year, and when I retire next year I’ll drop to 60% of that. Don't those bastards understand who produced the drug that created all the wealth? Yes, I think they understand. I think they just don't give a dang.”
That was all Dr. Whitten said aloud. But the longer he thought, the angrier he got.
It ate and ate at him, eventually reaching the point where he couldn't take it any longer. He briefly contemplated rigging a virus release in the laboratory but that didn't make sense. His fellow workers weren't the problem and he wouldn't do anything to harm them. Management was the problem and they didn't work in the laboratory, they divided their time between the head office in New York and company facilities scattered across the globe. They spent their time flitting from place to place on one of the company jets rather than working...........wait a minute - that's it. The company aircraft! Planes carry top executives. And planes crash.
He established several guidelines. First, his plan must not put him in physical danger. Second, to the greatest extent possible it must not put innocent parties in danger. Third, it must be repeatable because it may take several crashes to achieve the objective. That ruled out trying to plant a bomb on a company aircraft. He might get by with it once - or he might get caught or be blown up in the attempt - and in any event he couldn't manage it repeatedly. Bombs were out, he had to find another way.
If there was one thing Tom Whitten knew how to do, it was research. He had no aviation knowledge beyond a lot of coach class business trips and a handful of trips in company jets, plus the little he remembered from his military days. He had no specific knowledge of how to cause a plane to crash but he had faith it could be done.
So he went to work. He combed aviation journals at the university. He combed the internet. He kept meticulous notes. Under an assumed name he called various aircraft and avionics manufacturers and interviewed engineers about system specifics. He talked with FAA maintenance personnel too. All the information was there, in the open. It wasn't classified, it wasn't trade secret, it wasn't even company confidential. He asked how a plane was navigated, how it interfaced with Air Traffic Control. He learned what the crew did and what systems they depended on for guidance. He learned what portion of the flight was most hazardous and vulnerable. He studied the localizer and glide slope and marker beacons and DME and GPS and all the rest. He bought a Radio Shack airband radio and became familiar with communications jargon. Eventually Tom found the RTCA documents that contain the standards each navigation system must meet. Every tiny detail was openly available.
And he learned about ADS-B. When Dr. Whitten located RTCA DO-242 he knew he had found the mother lode. This was the key to the whole plan. He wanted to destroy specific aircraft while causing no harm to others. ADS-B reports the precise location of the aircraft, in 3D coordinates, and simultaneously reports the identity of the aircraft. That was exactly what his plan had been missing, the means to target a specific plane, and ADS-B provided it.
Outsiders imagine that lab researchers spend their days stirring test tubes and peering into microscopes. Once upon a time that was an accurate picture, but electronics is the dominant force today. Tom was skilled in designing instrumentation to solve fresh problems. Now he turned this talent to his new field of interest.
In ADS-B, every plane has a unique 24 bit identifier which remains with the aircraft. In fact, there is an algorithm to convert tail number to ADS-B identification number. It was a simple matter, with binoculars, to get the “N” number of the company jets when they came to town. Dr. Whitten then hand-processed the algorithm and learned the 24 bit ID code of each plane. Now he could receive the 1090 MHz frequency and know which plane was which.
His plan was simple. On an instrument landing the plane is following electronic signals. The localizer gives left/right guidance, the glide slope provides up/down information. The former is on VHF, the latter UHF, with the frequencies openly available on aircraft approach charts and other documents. The signals are not encrypted, they aren't even digital. The ILS signal, like most of aviation technology, was established near the end of World War II and long before the invention of the transistor or integrated circuit. Some systems (such as the ancient amplitude modulation used for voice communications) date back far earlier. Aviation is unlike other fields of endeavor because the people who develop the technology are not the people who use the technology. And a third group who are neither skilled in the technology - nor skilled in the use thereof - are the ones who make the decisions. Through the years a lot of wacky decisions have been made. In the case of ILS, the radio carrier is amplitude modulated by two tones, 90 and 150 Hz, which are equal amplitude if the plane is centered on the beam. If a particular aircraft receives a false signal it will follow a false path.
Traditionally the marker beacons, all on 75 MHz, give the pilot an indication when he is nearing the airport but do not allow any sort of readout to the touchdown point, so Tom could ignore them. Often the pilot monitors his Distance Measuring Equipment, DME, to determine his distance to touchdown. Tom reasoned that it would be easiest to simply jam the DME frequency for the critical few seconds. Likewise with GPS, once he had identified his particular aircraft he would jam the very weak Global Positioning Satellite signals on 1575 MHz.
None of this was particularly difficult for an experienced researcher such as Dr. Whitten. Indeed, a kid with an interest in ham radio could do as much. But Tom had access to decades of obsolete instrumentation from which he could scrounge the necessary bits and pieces. The ultimate irony, he could use company material to accomplish the objective.
It was easy to phase lock the ILS spoofing transmitters to the real ILS signal, from a van parked a mile or so from the airport and under the final approach. He used directional antennas that beamed his signals upwards to the particular flight while anyone else on the approach would receive the proper ILS signal. Phase locking his signals to the actual ILS would assure that there would be no flag or indication when the target aircraft transitioned from the correct signal to the spoof. Sure, it took some effort, but the specifications were all available so it was far easier than other projects he had accomplished.
The weather was miserable the night of the first crash. Most flights were landing successfully, but missed approaches weren't uncommon. Some planes were experiencing airframe ice, winds were gusty and unpredictable, the rain was heavy at times, and ATC had traffic backed up halfway to Cleveland. The company Gulfstream IV was making what appeared to be a normal approach when it began to drift to the right. It descended prematurely about a half mile from the end of the runway, struck an embankment at the outer perimeter road, bounced over two maintenance buildings and a communications shack, hit the ground with its left wing, cartwheeled, and burned. All aboard were killed.
The NTSB accident investigation concentrated on the navigational aids, aircraft systems, ATC actions, and crewmember performance. The ILS checked out perfectly and no other plane had experienced any ILS problems. The aircraft systems checked out OK, at least the parts that could be reconstructed. ATC had made no blunder and there was nothing on the communications or radar recordings to indicate a problem. Predictably, the crash was blamed on pilot error.
But Thomas Whitten, Ph.D., wasn't finished. Several months later, at a different airport, the same pharmaceutical company mysteriously lost another flight."
