Kurt Schwehr's backup blog: AIS Integrity and Security

Disclaimer: The opinions here are my own and do not represent Google, SkyTruth, Global Fishing Watch, or the Univ. of New Hampshire. I work for Google, co-founded Global Fishing Watch, and am an Affiliate Professor at the Univ. of New Hampshire.

With recent events with the US Navy alliding with commercial ships and people asking if the blue ship could have been hacked, it's time to dust off the old notes. I've wanted to write a paper (or 10) about this topic since about 2005. I might as well try in blog form to get out what I have.

First some old material material...

Back in 2012, I made this blog post: AIS SECURITY AND INTEGRITY. My whiteboard from that exercise:

http://schwehr.org/blog/attachments/2012-11/20110429-ais-security-integrity.jpg

And I started a doc for a paper and here is what I had as of 2010:

Integrity and Security of the global maritime Automatic Identification System (AIS)

Kurt Schwehr

In 2006, the several people in the US Government encouraged me not to write a paper on the security of AIS. I have concluded that it is important to discuss these issues in the open. Security through obscurity is not a good solution. Many people have already thought through how AIS is vulnerable, but there has not been a source of information to the typical mariner or marine manage that lays out the issues. AIS is an effective tool for maritime activities, but care needs to be exercised when using or trying to improve the system. Changes to how AIS is used in real-time or post processed for analysis of water way activities can have unexpected consequences some of which can have negative environmental and economic impacts or put the mariner at greater risk of harm.

Unsorted

Bandwidth limitation
No official standard for logging with metadata (especially time) and transmitting over internet and other secondary channels
Limited reliable transmit capability
MKD is horrible and error prone. Often not located in an easily visible portion of the bridge
AIS might not be integrated into ECS and/or ECDIS systems
No standards for autonomous vessels
Repeaters can quickly flood the AIS channel
Incorrect understanding by mariners and data analysis of what AIS means
Poor monitoring of AIS receiver networks
Larger messages have a higher probability of packet collision
Patent encumbered technology
Regulatory environment - not much room in the United States for experimentation and research
Can you issue penalties for behavior recorded only in AIS received reports?
Should fishermen install or block AIS on their vessels? The proprietary knowledge of where they fish.
Attacks targeting vessels based on AIS. Is this really any worse that without AIS? e.g. Boston’s north LNG terminal.

Time and Positioning

What time does the position translated relate to?
Partial timestamps in packets and accuracy only to the second
RAIM seems like it is not really useful to indicate position accuracy
Offset issues between the ship reference point and the GPS reported by Pilots
Knowing where your receiver is located when getting data from networks such as NAIS
Timestamping of received messages that happens down stream may get very confusing.
GPS errror example from 2009 NOAA review in portsmouth NH

Radio noise and propagation issues

NOAA weather radio transmitters and other systems that put energy into the AIS spectrum
Inland use of the same spectrum
Noise on the GPS channel and solar issues
better propagation conditions that tunnel packets between cells will cause interference
currently not enough satellites and ground stations to give realtime global coverage

Receiver and Transmitter issues

Weak checksum scheme may create valid packets
Cheap receivers might decode noise as valid
Single channel receivers will miss half of the message traffic
VHF propagation issues prevent seeing distance ships most of the time
Transmit antenna height and power greatly matter for receive potential
For remote receivers, how do you know they are working if you aren’t sure there are transmitters in the area. E.g. Antarctica (or little bay)

Class A or B units

- Turning off the unit (trivial to accomplish) or power failure
- Loss of GPS - antenna, urban canyon, multipath, kalman filter problems
- Unintentionally mis-configured devices. Human error, system failure, sensor failure, antenna failure
- Intentionally incorrect devices. How to confuse people. What can you reprogram on a Class B?
Inability to match to an exact vessel in other registries
broadcasting bad time
Bad carrier sense in Class B
Long term scalability of the number of units that can be on the channels
How good is the self reported heading, ROT, speed? Which sensor is being used? Does the GNSS have any extra capabilities beyond just the traditional GPS? WAAS, Diff, satellite transmitted corrections like CNAV, RTK?

Transmissions by non-blue force (e.g. normal operations)

Not encrypted - Even addressed messages are received by all hardware
No cryptographic signature capability - impossible to assure identity
Specifications such as Circ 289 require people keep already public data protected
No way to TX position securely in areas with pirates
There are free and pay networks that will give realtime AIS to anyone. Not everyone is willing to acknowledge this.

Blue force encrypted transmission

Lack of comm state in message 8 makes scheduling of slots difficult for other vessels
Direction finding may still identify the location of military or law enforcement vessels with COTS receivers
Is the encryption really secure?
It is unclear what the policy for switching between silent, secure, and normal modes
Is the encryption really secure?
The DAC/FI is not always the same and may infact be random

SAR and other aircraft

Broadcasting at altitude can span many cells and cause wide spread interference
May hear other cells and be less able to receive (solvable as evidenced by satellite)

Basestations and ATONs

reserving slots to consume bandwidth
telecommand to change reporting rates
changing the frequency of AIS units (see USCG announcement)
sensor failure for met hydro might go undetected or predicted not noticed as such

Software or hardware units that are not type approved

Accidental or intentional interference on slots
Ghost fleets of fake ships - Spanish?
Transmitting incorrect info for correct ships

Software and hardware QC/QA problems

Paywalled specifications
Closed testing
Connector design problems
Very few ports have knowledge, means of detecting, and technicians to correct bad or misconfigured AIS units. SF is an exception
Complicated specifications lead to errors in implementation
Ambiguous message definitions because of the lack of use of a formal language to define messages.
Lack of evolution in some specifications have led vendors to innovate on their own with incompatible and/or undocumented changes (e.g. Ohmex)
Units are inconsistent in between messages. This should be uniform for the network and configurable at the presentation interface when displayed
No official catalog and registry system where countries can submit their regional messages

Possible improvements and solutions

All is not lost! AIS is an effective tool for many maritime tasks and likely is making the job of safe navigation much easier. The system as it stands is much better than in the 1990s. Ships now know more of the names of ships around them so that when they call on VHF, they know who to address, they can get better directional information

Transmitting on other frequencies (and possibly coding schemes)
I-AIS standards
Best practices documentation for design of new messages
Open and free documentation and open certification processes
Define international standards for raw logging and transfer with JSON and XML messages between applications
Better suggestions for monitoring receiving integrity
Explicit documentation on how to calculate time to go with a position
Best practices for receive networks
Watch standers guides need to include sections on the configuration, maintenance, testing, and use of AIS data to make sure they are transmitting correctly and properly interpreting/using AIS data. e.g. update rate is not on any AIS displays that I’ve seen