BizAv Privacy: How to Fly Incognito in the USA

Until the FAA made ADS-B Out use mandatory for flights in most US airspace in 2020, it was fairly easy for owners and operators of business aircraft to prevent the public – particularly business rivals, criminals and terrorists – from knowing exactly where in the nation each of their flights was bound.

Before then, US Business Aviation operators could make use of an FAA program known as Limited Aircraft Data Displayed (LADD), previously known as the Blocked Aircraft Registration Request (BARR) program in either of two ways to keep the details of their domestic flights hidden from not-so-casual third-party interest, according to Christian Renneissen, Collins Aerospace’s manager for flight deck connectivity.

One way operators could use LADD was to ask the FAA to block their flight details going to vendors of flight tracking data at the source level, by asking the FAA itself not to provide that data to the vendors. (Until ADS-B Out use became mandatory in the US, flight tracking data vendors relied on air traffic control data provided by the FAA as the source of their data on all US flights.)

The second way, according to Renneissen, was for Business Aviation operators to ask the flight tracking vendors not to make the details of their flights available to the public, but to provide each operator’s details to that operator to allow it to track its own flights. This process is called “limiting the display of aircraft data at the subscriber level” and is requested from the FAA.

Most operators chose the second option, and some reputable flight-tracking vendors (FlightAware being one example) continue to honor such LADD requests to this day, Renneissen says.

However, the mandating of ADS-B Out usage in most US airspace, and the consequent growth of a number of web-based flight tracking vendors which display flight data based purely on ADS-B broadcasts has made the LADD program much less effective, according to Renneissen.

These vendors take data received by many thousands of inexpensive, privately-owned ADS-B receivers worldwide and aggregate the data to provide a global, real-time picture of nearly all ADS-B-equipped flights taking place at any given time.

(Obtaining live ADS-B data from flights in mid-oceanic or remote terrestrial airspace requires a data feed from a professional provider of space-based ADS-B data, however.)

Web-based vendors can make highly detailed ADS-B aircraft positional, and identity data available to the public, because every aircraft equipped with ADS-B Out capability broadcasts, once or twice every second, a large number of moment-to-moment positional and identification details about the flight it is currently operating.

These details include the exact identity of the aircraft in terms of its registration or ‘tail number’ – for US-registered aircraft, a combination of the prefix ‘N’ and up to five numbers and letters – and its unique ICAO ‘hex’ address (a 24-bit digital address, usually expressed in six-character hexadecimal form using a combination of the letters A to F and the numbers 0 to 9).

After January 1, 2020, US Business Aviation operators quickly became concerned as to how they could continue to keep the details of their domestic flights private for commercial and security reasons.

Responding to their call, the FAA introduced a novel and effective way of making such flights in domestic US airspace effectively anonymous, by creating the Privacy ICAO Address (PIA) program under the ‘ADS-B Privacy’ umbrella.

How PIA works

PIA involves two main elements, and operators interested in participating in the program have to apply to the FAA to participate, according to Renneissen. Key to the program’s operation is that the FAA maintains an inventory of unassigned ‘N’ registrations.

The first element of PIA is that the FAA has reserved some of these unassigned registrations for the PIA program and makes them available to eligible PIA applicants. Upon approval of its application an operator receives a PIA, which is a six-digit ICAO hex address that translates to one of the reserved 'N' registrations.

The FAA then allocates this hex address/tail number pairing as a spurious identity to an aircraft whose true identity its owner/operator does not want third parties to be able to ascertain as it performs US domestic flights. 

For all FAA airworthiness, maintenance and title purposes, the aircraft continues to wear its real tail number: the spurious one is never painted on the aircraft, Renneissen says.

It is important for the PIA program, and for maintaining ADS-B privacy, that none of the unallocated ‘N’ tail numbers used for the PIA program is ever allocated to any aircraft as its true tail number while the program is active.

Each pairing of an ICAO hex address and spurious tail number can be permanent if the operator chooses, but usually it is temporary, in order to maintain a secure level of ADS-B privacy over time. It is only allocated to a given aircraft once the aircraft’s owner or operator has successfully completed the PIA application process.

This process involves a number of application steps and one or two flights:

• The first (which may or may not be necessary, see below) is used to obtain verification that the aircraft’s ADS-B Out equipment functions properly using its original ICAO hex address and tail number.
• The second is needed to verify that the aircraft’s ADS-B Out equipment still functions satisfactorily after it has been programmed with its new, spurious ICAO hex address and tail number.

In applying for PIA participation, unless an aircraft has operated an ADS-B verification flight and obtained verification from the FAA within the previous 180 days, the operator first has to make a Public ADS-B Performance Report (PAPR) to the FAA by providing routing details of any leg of any flight the aircraft has operated within the past 180 days in which its ADS-B Out equipment was broadcasting.

The FAA can then determine from its own ATC data records whether the broadcasting performance of the aircraft’s ADS-B equipment was satisfactory during that flight, in terms of the accuracy of the information it provided and the strength of its broadcast signal.

Using Third-Party Callsigns

The second main element of the PIA program is the FAA’s requirement that each successful applicant use one of four third-party providers of flight planning services to provide it with that provider’s own callsigns for each US domestic flight the applicant’s aircraft makes.

Each callsign is made up of a three-letter prefix unique to the provider and then a flight number of up to four digits. Together with the aircraft’s spurious hex address and ‘N’ tail number, this ensures that the aircraft’s identity and ownership is effectively kept private for each domestic flight, as is each leg of a multi-sector flight if the callsign is changed for each sector.

The four flight-planning services which the FAA accepts for PIA are:

• FlightPln (owned by Garmin)
• ForeFlight (owned by Boeing)
• FlightAware
• ARINCDirect (owned by Collins Aerospace).

FlightPln’s three-letter callsign prefix is DCM, ForeFlight’s prefix is FFL, FlightAware’s callsign prefix is FWR and ARINCDirect’s prefix is XAA. According to Renneissen, ARINCDirect generates random XAA callsigns (each including up to four digits) for every single-sector PIA flight and a different callsign for every leg of a multisector flight. This makes the callsign-allocating process simpler and more efficient for ARINCDirect.

The company would quickly run out of callsigns if it allocated each one permanently to a given aircraft, because only 9,999 callsigns are available to ARINC, says Renneissen. Importantly, changing the callsign for every sector also makes it highly difficult for any third-party to follow a given aircraft’s movements throughout the day.

Required Effort More Significant Than Cost

The cost to operators of participating in the PIA program isn’t necessarily high. The FAA to date hasn't charged operators for PIA participation (see below), and ARINCDirect, for instance, provides its callsign-allocation service for no extra cost to any operator which subscribes to the ARINCDirect flight planning service, says Renneissen.

However, while cost isn’t necessarily much of a factor in deciding to become a PIA-program participant, quite a lot of effort can be involved on the operator’s part to make sure its aircraft’s ADS-B Out equipment output is configured properly for every flight the aircraft makes.

For one thing, the FAA’s PIA application process involves a substantial amount of form-filling on the part of the operator and also the need to obtain PAPR approvals both before and after the aircraft’s ADS-B equipment is modified to reflect its new, effectively anonymous, identity.

Modification of the ADS-B Out data output itself can be quite simple – it’s a matter of “pressing a few buttons” for some aircraft-equipment combinations, but some types require a new software load to change the information their ADS-B Out transmitters broadcast, explains Renneissen.

Installing a new software load is a maintenance task in itself and is usually performed by an avionics technician where possible. 

Additionally, changing a PIA-participating aircraft’s ADS-B Out broadcast output to reflect the aircraft’s true identity is required every time the aircraft operates a flight which is international in nature or which does not remain within the boundaries of the 12 nautical mile-limit of US territorial waters, Renneissen notes.

The latter restriction prevents program participants from planning any PIA-protected flights over the Gulf of Mexico between Florida and Texas, and between the US continental mainland and Alaska or Hawaii (though flights within the Hawaiian Islands are permitted to use PIA anonymization).

Unless an aircraft operates entirely within US domestic airspace limits and its 12-nautical mile sea limit, its operator may have to modify its ADS-B Out output frequently.

The only exceptions to the ‘within-12nm-rule’ for PIA-protected flights are when an aircraft operating a US domestic flight is vectored over water by FAA air traffic control to avoid bad weather, and when FAA controllers route its landing approach or departure more than 12nm beyond the coast.

The restrictions above mean that, “for some operators, PIA is no good because their operations are so random,” says Renneissen.

Renneissen says that operators initially showed substantial interest in the PIA program when the FAA launched it, but “interest in the program tapers off quickly when operators learn of the effort involved in changing from an aircraft’s original hexadecimal address to a PIA address.”

That said, he notes, PIA ADS-B privacy protection “is being used very frequently” by ARINCDirect subscribers which are PIA-program participants.

Other Factors to Consider

Operators should note a number of other factors which may influence their decisions whether or not to apply for PIA ADS-B privacy protection for their US domestic flights.

• One is that the service is not available yet for 978 MHz UAT ADS-B Out transmitters or for dual UAT/1090 Out transmitters, though it is allowed for dual 1090/UAT receivers.
• Another is that operators are not allowed to change an aircraft’s PIA address and tail number during a flight, though the operator is allowed to broadcast the aircraft’s actual ICAO hex address and real N-prefixed tail number at any time during a flight.

Each aircraft’s Emergency Locator Transmitter requirement remains unchanged by PIA, which means that if the aircraft ditches or is downed terrestrially then its ELT will broadcast the aircraft’s real ID.

Additionally, the FAA discourages the use of controller-pilot data link communication (CPDLC) messaging during a PIA-protected flight, because “CPDLC sessions currently require the aircraft’s registration number to correlate communications between the aircraft and the CPDLC ground system,” the FAA says in its PIA Articles of Use.

“The availability of this information from the flight plan and subsequently within FAA automation would compromise the identity of the PIA operation for that aircraft.”

Importantly, also, “All aircraft information held by the FAA which is associated with a PIA used primarily and predominantly for business or commercial purposes will be available from the FAA via the Freedom Of Information Act upon request,” the PIA Articles of Use state.

“The FAA does not consider PIA assignments used exclusively for commercial or business purposes confidential commercial information that is protected under Exemption 4.” In practical terms, however, operators don’t have much to fear from this FAA warning. At present any operator can apply to change its aircraft’s PIA-generated spurious identity every 60 days.

Among other things this means that the PIA identity with which an aircraft is cloaked now may in future be allocated to another aircraft entirely. So third-party FOIA inquiries regarding a given operator’s, owner’s, or aircraft’s movements can at best only be of historical interest to FOIA applicants.

A Two-Phase Program

Flight Departments should also take into account two other important factors when considering PIA participation. First is that the FAA has always regarded PIA as eventually being a two-phase program.

PIA is still in its first phase, in that it is still being administered and run by the FAA. For the second phase, however, the FAA plans to hand over operation of PIA to one or more third-party service providers (in all likelihood private-sector in nature).

This may or may not result in significant extra cost to program participants. What the change is planned to bring, however, is the ability for program participants to change their aircraft’s PIA identities every 20 days, rather than every 60 days.

Last but not least as a point to consider: Renneissen believes ADS-B privacy is unlikely to be offered by other nations’ civil aviation regulators in the near future.

“From the operator side, there’s definitely interest outside the USA,” he confirms. But most countries’ regulators aren’t keen on the idea of providing ADS-B privacy because they want to be able to track and identify accurately all the aircraft operating in their airspace, for aviation safety reasons, and to quickly and conclusively identify any aircraft which is involved in an accident or incident.

Learn more about the US PIA program at https://www.faa.gov/nextgen/equipadsb/privacy/

Read more about ADS-B in our Avionics for BizAv articles