Schneier on Security
A blog covering security and security technology.
« Britain Adopts Threat Levels |
| A Month of Browser Bugs »
August 3, 2006
Anti-Missile Defenses for Passenger Aircraft
It's not happening anytime soon:
Congress agreed to pay for the development of the systems to protect the planes from such weapons, but balked at proposals to spend the billions needed to protect all 6,800 commercial U.S. airliners.
Probably for the best, actually. One, there are far more effective ways to spend that money on counterterrorism. And two, they're only effective against a particular type of missile technology:
Both BAE and Northrop systems use lasers to jam the guidance systems of incoming missiles, which lock onto the heat of an aircraft's engine.
Posted on August 3, 2006 at 7:30 AM
• 30 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
OK. So is this how Boeing and others reach out to find new business models by arming civilian structures ? Interesting, yet unaffective. I would like to see SAM sites deployed all around our capital and major points of interests. I would also like to see a better warning system for aircraft that deviate off course, instead of relying on black boxes whose secret location is not secret anymore and available for extremely intelligent hackers that learn by birth to break into uncrackable cryptographic systems before the age of 5.
Terrorism, to me, has been around since the dark ages and there is no technology that can terminate the movement. As long as governments exist, so will a peoples right to bare arms against oppression. America needs to be focusing on its psychological component overseas more than anything.
If technology can't terminate it, why are you so focused on it? Seriously - Surface to Air Missile sites?
Here is another aticle, almost three years old, on a similar topic.
At first glance, the technology for the BAE/Northropp system does not seem much different from that decsribed back in 2003.
It's unfortunate but I think Bruce is right when he says the money would be better spent elsewhere. Even if the airlines do succeed in deploying cost effective defences against heat seeking missiles, it is just a matter of time before a "smarter" missile comes along or another threat.
haha, now that's gonna be fun. Let's look at a scenario in the near future:
1. Terrorist get's a hold of the technology specification that allows to control planes remotely in case of an hijacking.
2. Terrorist hacks into the system and steers it towards the white house.
3. By accident someone actually notices it and starts up all 500 SAM-sites.
4. Within minutes there is more missiles than birds in the air.
5. The aircraft disables / confuses the missiles thanks to its new anti-missile system.
6. Plane is now unstoppable and crashes in its destination.
7. Terrorist giggles silly and hacks the next one.
More than sometimes one has to wonder for whom the governments actually work.
"Under pressure from Congress in 2004, the Homeland Security Department gave Northrop Grumman Corp. and BAE Systems Plc $45 million each to adapt military missile defense systems so they can be used by airlines."
So instead of wasting "billions" to outfit each aircraft, they only wasted $90 million to get the things developed? blech.
Why is the focus on negligible risks? This isn't a common problem, nor does there appear to be sudden rash of airplanes being taken out by missiles. This focus detracts from more likely and more practical forms of terrorism. For example, there's someone in Phoenix going around indiscriminately shooting people. That's an effective form of terrorism and costs very little. It really comes down to where you draw the line between nutjob and terrorist.
I'm not familiar with the black market for military weapons, but I would think heat guided missiles would have a hefty price. A few hundred thousand a piece, at least? That's a lot of money to put into a single attack when there are so many cheaper options available that cause more panic. The total cost of the London subway bombings would have been far less, and had a larger impact on society than taking out one plane. I don't think the people who plan and fund these activities are stupid. They have a lot of experience in getting the best bang for their buck.
It's quite telling that the executive vice president questions whether the expense matches the risk, while the politician evokes a purely emotional argument of what would happen if a $5k missile took out a $130m 767. Politicians are always willing to let other people spend a lot of money if it means they might get a couple more votes. They don't ever see the impact of their decisions. I like the viewpoint of the VP of our group - is this something we need to do, and if so, who are we going to fire to get the money to do it? Putting it in those terms tends to bring people down to earth.
I want to know what they mean by testing this on cargo aircraft. The only way I can think of to effectively test such a system is to have a group of people firing missiles at the equipped planes. While they wouldn't have explosives for testing purposes, it just seems like there's a lot of potential for something unexpected to happen. For example, a missile getting through and hitting an engine would be bad. Self destruct mechanisms use explosives to turn a big missile heading in a particular direction into a bunch of small pieces that still follow the laws of physics.
We're looking for ways to spend ourselves into bankruptcy. We made the Soviet Union do that with the arms race. Why are we falling for the same scam? There is nothing we can do that will prevent every bad thing from happening. The only rational thing to do is address actual problems with practical solutions. Here, we're putting disproportionate focus on a very rare occurrence.
Yes the systems are only effective against heat seeking missles, the most common and inexpensive targeting systems available. Hundreds, if not thousands of such missles are available worldwide. They have been used a number of times to target commercial jets.
Would you not want a sprinkler system in your office building because the only thing it would protect against was fire?
"Would you not want a sprinkler system in your office building because the only thing it would protect against was fire?"
Not the best analogy. Security isn't about protecting yourself from random bad things, they're supposed to protect you from an intelligenct and malicious adversary that knows your countermeasures and is actively working to get around them. If fires could adapt to sprinkler systems -- that would be a better analogy.
That being said, security is always a trade-off. There is a cost for sprinker systems that is too high, regardless of how nasty a fire could be. There is a cost for aircraft anti-missile systems that is low enough, regardless of their limited effectiveness. Right now I think that anti-missile technology is just too expensive for the security it brings.
While I agree that the money could probably be best spent fighting other threats, if we *are* going to do something about SAMs, I'm not sure what other kind would need to be defended against. Hand-held systems are currently the only plausible SAM threat to civil aviation. AFAIK, those are all heat-guided. There are also a disturbingly large number of them floating around unaccounted for.
Another question would be whether the use of flares was considered. They would probably be a lot cheaper, although there would certainly be some safety concerns. Perhaps that idea was drowned out by shouts of "Cool! Frickin' laser beams!"
Yet another case of a solution looking for a problem !!!
>>Would you not want a sprinkler system in your office building because the only thing it would protect against was fire?
1) Fires happen, with sufficient frequency that fire insurance is a mature and stable part of life.
2) Reliable steps against fire are well established (sprinklers, fire departments etc) with known and predictable cost. Protecting against fire normally does not siphon huge amounts of money from protection of more common threats.
Alas we COULD provide anti missile defense the cost of only a month's operation in Iraq...... for the cost of another month's operation we could have modernized our ports...
Again, I'd rather pay for SAM sites and protect my infrastructure against a runaway object rather than hoping that an overblown, undertested military system will do the job for me.
Oh...Can anyone tell me about our missile defense shield ? From what I heard, it was operational and tested ! Maybe we can use that same technology on the planes...jack up airfare and just say that now planes are more safer than ever to fly on...give me a break.
Military spending PERIOD is out of hand, period. And a government can and should never be in the business of protecting against the most probably and theoretical, but rather against what they do know. I agree 100% with Mike. Should we not assume that China or Russia is funding Al Queda to help terrorize the American government into out of control military spending and misguided American policies that can only lead into severe blowback for future generations to come. I mean, history has decided the fates of out of control, over reaching governments in the past, has it not ?
"There is a cost for sprinker systems that is too high, regardless of how nasty a fire could be."
Sprinklers took a while to adopt, actually. They were first designed by John Carey in the early 1800s for cotton gins and warehouses that had an extremely high risk, but the technology took many years to mature and many more years were spent trying to get people to accept sprinklers as a reasonable control. I think it was roughly 100 years from invention to a point where they become a practical application for reasons of cost and otherwise...
Wild tangent on sprinkler systems->
In the US, NARA (the National Archives and Records Administration) still officially supports wet pipe fire suppression systems for archival storage facilities. In many other countries, however, standard wet pipe fire suppression systems are limited to use spaces only, and inert gas systems are recommended for actual storage facilities.
According to at least one librarian I know, this is because the US adopted facility fire suppression systems as a required standard before most other nations, and at the time wet pipe systems were the only option. (The logic being that it's better to try to dry out a bunch of soaked paper than sweep up ashes). Since there is a large investment in wet pipe systems (and no budget money to yank them out and replace them with inert gas), it is unlikely to change in the near future - at least, not until the existing facilities are decomissioned or something important gets destroyed by a sprinkler system.
Just an example of how early adoption of a security/safety technology can "lock you in" when something better comes along...
@xyz: That $90m is to do development studies. If you design something, you still need to produce it. If it's only $5M per plane; times 6800 planes is $34B. The entertainment system is a plane, a glorified VCR, costs almost $5M. Plus, this $34B does not include the operational cost, even if it is just the jet fuel to power the box and lug it everyplace the plane goes.
The problem with this solution to the movie plot of a terrorist with a Manpad shooting down an airliner is that it adopts a military requirement that does not exist in the commercial aviation world. Military planes have this sort of system because they fly everywhere and land in random places on hastily made strips.
Commercial planes land in specific, non-random places. They are called airports. We know where they all are. There are many less airports than airplanes, as anyone who's been in the takeoff queue in Chicago well knows. You could decide, based on the sort of risk assessment that the fire insurance industry exemplifies, Manpad is a threat you need to prevent. If you do, then the solution is some per-airport gizmo, not a per-airplane gizmo. Only the folks who make them want per-aircraft gizmos. Engineers want a per-airport gizmo, where you have unlimited power available and no size or weight restrictions.
You miss the point of spending all that money -- yes, it was wasted as far as generating a viable solution, but it was well spent from the stand point of proppig up the companies and providing employment in certain districts, and helping out political friends...
As to the technology, what does El Al use these days? They've certainly had experience with their planes being fired upon...
The problem with SAM sites around the nation ('homeland', bitte) is that each false positive means an innocent aircraft gets shot down. Since hostile aircraft are rare to the point of being virtually nonexistent, then virtually all positives will be false positives.
The only politically acceptable 'friendly fire' death rate would be mathematically zero.
This can be reached by turning the missile operation systems off, and turning their radars off, and keeping them off, except for routine testing, thereby saving maintenance and power costs.
Where domestic ('homeland', bitte) SAMs and radars have already been set up, the OFF policy (Obviate Friendly Fire) is already SOP.
Now consider what happens when airliners are equipped with countermeasures and the true positive rate remains at mathematical zero: now and then some gizmo is going to get confused and 'think' woe-is-me and will activate. If this happens in the air when no other aircraft are nearby, probably nothing bad will happen. But on the ground or on takeoff or while landing, misfires could cause serious problems.
Thus when airliners are equipped with countermeasures, the only safe policy is the OFF policy: turn the system on only for routine testing, then keep it off the rest of the time.
BTW, protection against heat-seekers would be easily defeated by developing acoustic homing: airliners on takeoff or landing are noisy. Acoustic homing should be very cheap: most parts would be available at Radio Shack. Countermeasures here would require decoys so loud as to drown out the racket of the jet engines, which no neighborhood would tolerate.
Also, the fire analogy works if we think of protecting against arson. Note that a sprinkler system is defeated if the arsonist first shuts off its water supply, or breaks open the pipe supplying the water.
These comments illustrate another risk from movie script thinking. There have been 57 recorded missile attacks on civilian airliners when last I counted, and more probable attacks. This is way past movie script. It actually reaches the level where you can speak about having experience, seeing trends, etc. But the current security apparatus is so intensively movie script driven that people assume that this is another movie script scenario.
The current decision is probably the right one. Based on experience, the present perimeter security and availability of manpads makes deployment of aircraft protection a poor choice. But it is not obviously stupid. It is just too expensive. So a modest research effort into developing better less expensive defensive systems is a good investment. It may be that the availability of manpads will change significantly. It may be that they will find a way to drive down the cost.
The last analysis that I saw put the justifiable cost threshold somewhere between 500K and 1,000K dollars per aircraft. With a production run of 10,000 and the present continuing drop in cost for electronics, this might happen. One of the larger cost factors was the impact of extra weight and drag on fuel consumption, and that is an area where engineering improvements are very likely.
The ground based shoot down missiles is a better example of movie script. There are 50 years of experience and success diverting and confusing missiles with aircraft based systems. There are zero years of success with ground based systems. But ground based is macho, and sexy, and full of lovely government research dollars. So ground based gets the press. Aircraft based technology is that boring messy nasty real world engineering stuff with experience and tradeoffs instead of dreams.
Actually I think the sprinkler analogy to security is pretty good. Security is locking doors, putting things in safes, putting up a barbwired fence, etc. It's more about making things difficult. A building with a sprinkler system may still burn down. The sprinkler system is designed to make that more unlikely in order to enable people to safely escape the building before they die.
A missle defense system designed to protect an airplane from being shotdown is not intended to prevent the missle from being acquire by the terrorists, and fired. It is only designed to prevent it from hitting the aircraft.
Counterterrorism and Counterintelligence are responsible for preventing the missle from being acquired or fired in the first place. People in those fields are worried about the adversaries actions to evade detection and capture.
Security may detect them or prevent them from being succesful but it is not actively seeking them or investigating them. Much like the the sprinkler system is not design to prevent the fire from starting, the missle defense system is not design to prevent launch.
How about some statistics on how many commercial airliners have been shot down in America by a terrorist with a shoulder fired missile? Here they are: 0. Yep, that's right - the big goose-egg, zip, zilch, nada, none, ZERO.
This stupid idea brought to you by the same mental giants that invented $600 toilet seats and $100 hammers.
This would be merely a eugenics programs for terrorists: to develop a new breed of terrorist that does not use heat to guide his missiles.
@rjh: How many of the 57 Manpad attacks on airliners were in the US? Interesting. There are military groups, or I guess I should say para-military in deference to the national militaries involved. These groups actually control territory in the countries where the attacks occurred. Even MS13 in Los Angeles doesn’t control territory to the extent they can launch missiles at their enemies.
I didn’t mean to imply anti-missile intercept technology. I’m thinking of either a high power phased array radar, something we know how to build and direct, or a high energy laser. This isn’t Star Wars, shooting ICBMs at 10,000km. This is local landing area point self defense for 10km around an airport. Put the generator next to the runway crossing, give it the location of airplanes in the area, and fire on warning. We already know where all the planes are, they should be exclusion zones. There will be false positives (potentially all the positives) but the only damage is some high energy photons launched into the air. Pick the right color, folks might be entertained, although IR is probably more effective.
All of the attacks so far have been outside the US. Experience with overseas attacks indicates that there are several big reasons that the US has not seen manpad attacks:
a) Manpads are expensive and difficult to conceal. This is not a 100% barrier, but it significantly changes the terrorist risk profile. Most attacks have included factors that reduced the cost or enhanced concealment, e.g., local civil war.
b) Most US airports have a large perimeter defense area (for other reasons) that make the smaller, cheaper, easier to hid manpads ineffective. Range is a big issue for manpads, so a small exclusion zone has a big impact.
c) Manpads have a poor effectiveness level at longer range, and the US has a high effectiveness level on catching people post attack. So even if you get past a) and b) the terrorist has a poor risk reward ratio.
All of this can change, which is why the research into more effective defenses makes sense while deploying current defenses does not.
derf: all aviation qualified equipment is expensive, by a typical 5x factor. The cheapest terrestrial GPS I can find is under $80. The cheapest aviation GPS is about $400. Your $600 toilet seat was actually a $600 toilet housing with seat. Paying $20 for a hammer or $120 for a toilet housing is not unusual. The aviation ratio continues to hold.
Rsaunders: The current defenses use medium power IR (laser and non-laser) to confuse the targetting sensors. Details remain classified. See basic texts like Schleher's "Introduction to Electronic Warfare" to get the concepts. Up close you need to worry about burns I suppose, but once the jet engines are running those engines are a much higher risk. So all you need to do is coordinate power to the defenses with engine start/stop. None of them seriously damage the manpad in flight. They just confuse it into missing the airplane, usually by deception or overloading the missile sensors. E.g., if you blast the sensor with a bright enough light a sensor might think that it has found the sun and start hunting for where did the airplane go. Keep confusing the missile while the airplane climbs and the missile passes underneath.
I was under the impression that El Al did have some kind of anti-missile countermeasure on their planes -- the "near miss" on the Israeli plane taking off from Kenya was attributed to flares or somesuch... Maybe that was just a rumor. On the other hand, if they do have countermeasures on their planes, it stands to reason they'd want to keep the details secret.
A plane-based anti-missile system does make a bit of sense if it can be made reliable and cost-effective. A policy of equipping them on international flights only (at least at first) would limit the costs, while you could put the big bucks into securing domestic airport perimeters. Still, you run the risk of spending billions of dollars just to have planes blown up on takeoff by a couple of crack shots with dumbfire RPG-7s (at $10 a pop, for the benefit of any congressmen listening in).
ICRM systems are complex and dangerous. The mature and reasonably inexpensive ones involve burning gasses (which are not jet fuel, so need a separate storage and infrastructure. This strikes me as a critical calculation for deciding if its worth putting them on civilian airliners. How many fires are we willing to put up with to protect against a threat of missile attack?
Is this system gonna be considered critical for flight? If it breaks, do we wait to take off, or just go without?
Rumor has it (lets say) that El Al puts IRCM and similar systems on their aircraft, possibly modularly, as needed in high risk areas. We're back to the security services, etc. helping mitigate the risk.
Current (and older) MANPADS are touchy also. They are hard to use (require training for good results) and have components that expire, especially if stored in iffy conditions. The footprint mentioned above is very important. Airliners climb away from the range of such missiles very rapidly. In the attacks most clearly analyzed (publicly) the firing point was on or adjacent to airport property. A launch is very visible, so I should not think a second try would be possible (even assuming the terrorist is not attempting to escape), even if additional missiles were available.
The $600 toilet seats and $100 hammers bit is an urban legend. The military *did* pay $100 for a device that had a handle on one end and a striking surface on the other, but that was a 'hammer' in the same way that a mainframe computer is an 'adding machine'.
@ Daniel Pawtowski
I'm afraid it's all true. If you look into these anti-missle defense systems, you'll probably find it has more to do with a political relationship than any real sense of urgency or success.
Check out some of the GAO and Congressional reports related to waste and graft, if you think this is stuff of urban legend:
"Senator GRASSLEY: The Defense Department wants you to believe that they are making dramatic changes in the way things are purchased, particularly spare parts. I think the most out-standing example is the $600 toilet seat of 1983. And we thought that we had that problem taken care of and, 16 years later, the $600 toilet seat was costing $1800."
I hope you're not going to say that toilet seat was built out of a mainframe.
The narrator goes on to give an example of where the waste may come from:
"The GAO's analysis recommended to Congress and the Air Force that the Lockheed F-22 fighter program be delayed by seven years because our existing fleet of F-15 fighter planes meets the country's military needs. The Air Force reacted to the GAO's advice by making their report secret.
As long as the secretary of defense continues to advocate spending billions on the weapons and forces we do not need, financial reform will be as much of an illusion as the enemy these forces are designed to fight. And scarce resources will be unavailable for domestic programs that could make us a stronger, healthier nation."
Sage words, it seems to me, and military leaders themselves are not unaware of the problem:
"Admiral LaROCQUE: Well, during all the years I spent in the Pentagon and the military service, I knew that there were times when we did not always know where the money that we had spent actually went. But I had no idea the magnitude of the problem until I became immersed in these General Accounting Office reports. And they detail time and time again, in reports to the Congress, that billions of dollars are being spent every year in the Pentagon and there's simply no accountability."
I say the same money spent on missle anti-proliferation and airport perimeter controls would do a whole lot more for passenger security. I think that's the same thing we were discussing last year:
The only catch is that you have to get the very nations who benefit from the success of missle sales to agree to self-regulate and ultimately stifle the market for their products.
pshhh. forget reinvesting into military anything. Why not help improve this nation's infrastructure. Help encourage innovation by creating new jobs, building new schools...improving them...you know. Isn't big brother supposed to act like one ?
Not all shoulder-fired SAMs are heat-seeking.
Britain for example fields a beam-rider ... in this case, the missile rides inside a beam projected by the launcher (this beam can be radio, or laser, doesn't matter) and all you have to do is keep crosshairs(and thus the beam) on the target.
Such a missile's sensors are in the tail, so no amount of IRCM will help.
The other variation is SACLOS (semi-automatic command to line to sight) where again, you keep crosshairs on target, and the missile has an emitter in the tail (radio, or a flare) that a computer at the launcher's position can see, and compute deviation from the crosshair - then it sends signals to the missile to steer it back into the crosshairs, thus keeping the thing on target. The TOW anti-tank missile uses this (it is wire-guided) as well as several SAMs, like SA-19, SA-3, etc.
No amount of IRCM or ECM against the missile itself will work in these cases.
Currently, new shoulder-fired SAMs have significant range against slow-moving aircraft. It isn't huge, but it is significant enough that you can choose your launching area with -some- degree of freedom.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.