ADS-B Has No Password - The Unencrypted Broadcast, the Twenty-Dollar Receiver, and the Spoofing Problem Nobody Designed Out

Every ADS-B-equipped aircraft broadcasts its exact position, altitude, velocity, and identity into open airspace roughly twice per second - with no encryption and no authentication. Anyone with a $20 receiver can read it, and nothing in the signal proves the aircraft is who it claims to be. That openness is not a defect; it’s the deliberate design choice that made modern air surveillance cheap and universal, and it’s the same choice that exposes both your privacy and the system to spoofing.

What Is ADS-B and How Does It Work?

ADS-B stands for Automatic Dependent Surveillance–Broadcast, and the name hides how elegant the system is. Break the acronym apart: Automatic means it runs on its own - no controller has to interrogate you. Dependent means it depends on your aircraft knowing its own position. Surveillance means it’s a way of watching traffic. Broadcast means it goes out to everyone, not to a single recipient.

Compare it to old-fashioned radar. Radar is a question and an echo: a large rotating antenna throws energy at your aluminum and times the bounce to figure out where you are. Your aircraft is a passive object - it just gets pinged.

ADS-B flips this completely. Your aircraft takes a position from its GPS receiver - far more precise than any radar echo - and simply announces that position on the radio, over and over. Now your aircraft is the one talking, and the ground station just needs ears.

Why Did the FAA Build the System This Way?

The advantage is cost. A radar site is a multimillion-dollar rotating machine. An ADS-B ground receiver is functionally a smart radio with no moving parts - cheap enough to place on mountaintops, oil platforms, and small sheds in the Rockies where radar could never be justified.

That’s how the FAA extended surveillance into places radar never reached: down in valleys, out over the Gulf, and across terrain that used to be a black hole on a controller’s scope.

The performance gain is just as real. Radar might refresh your target every 4 to 12 seconds depending on the antenna. ADS-B refreshes roughly twice per second, with position accuracy of a few meters instead of a few hundred feet. That tighter, faster picture is what enables closer spacing and better traffic displays.

What Are the Two ADS-B Frequencies in the US?

In the United States, ADS-B runs on two different links, and this trips people up.

Airliners and fast turbine aircraft broadcast on 1090 MHz, a system called Extended Squitter, tied into their Mode S transponders.
Much of general aviation uses a cheaper second link on 978 MHz, the Universal Access Transceiver (UAT).

Two roads, one destination - the ground network stitches them together. If you fly below 18,000 feet and never leave the country, the UAT box is often the lighter, cheaper way to comply.

The mandate has been law since January 1, 2020. To fly in Class A, B, and C airspace - and above the Mode C veil around the big Class B airports - you need ADS-B Out. That part is settled.

Why Is ADS-B Unencrypted and Unauthenticated?

Every advantage above comes from a single design decision: the aircraft broadcasts its own position, in the clear, to everyone. The same choice that makes the system cheap, open, and elegant is what leaves it wide open.

Two facts define that openness:

There is no encryption. The position report is not scrambled. Anyone with the right receiver reads it in plain language. That was the intent - it’s a broadcast system, meant to be received.

There is no authentication. This is the deeper gap. Authentication is the part of a system that proves a message came from who it claims. Your bank’s text code is authentication; ADS-B has nothing like it. The message carries an aircraft identifier - the 24-bit ICAO address burned into your transponder - but nothing in the signal cryptographically proves the aircraft owns that address. The receiver trusts the message because it arrived.

Now add a third fact: the receiving hardware got absurdly cheap. A Software Defined Radio (SDR) dongle costs about $20, plugs into a laptop, and can watch every ADS-B aircraft for a hundred miles. The entire crowd-sourced flight-tracking world runs on thousands of ordinary people pooling data from these receivers.

So the surveillance system the FAA built for controllers is simultaneously, and by the exact same physics, a global public tracking network no one controls.

The Privacy Problem: Real, Present, and Only Partly Fixable

The first problem is privacy, and it’s not theoretical. If you fly an aircraft with ADS-B Out registered to you or your company, anyone can watch where that aircraft goes.

For a Cessna 172 on a Sunday, most of us don’t care. But for a business flying executives, a physician flying to a hospital, or anyone who’d rather not have a stranger correlate a tail number with a home address, that open broadcast is a genuine exposure.

The FAA offers two partial tools:

Privacy ICAO Address (PIA): An eligible operator can be assigned an alternate, rotating ICAO identifier that isn’t publicly tied to their registration, so the aircraft broadcasts but doesn’t trivially resolve to a name.
Limited Aircraft Data Displayed (LADD): Formerly the block list, this lets you ask the FAA to suppress your aircraft from the data feeds that flow to public tracking sites.

Here’s the honest caveat. LADD asks the big aggregators to hide you, and mainstream services honor that request. It does nothing to the $20 dongle on someone’s windowsill - that receiver hears your 1090 MHz squitter directly out of the sky. No list on Earth can un-transmit a radio wave you already sent. The privacy tools work against polite, centralized services and fail against a determined individual with an antenna. Both are true at once.

Can ADS-B Be Spoofed?

The second problem is spoofing, and it deserves the sober version, not the hype.

Because there’s no authentication, it is technically possible to build and transmit a fake ADS-B message: a phantom target that isn’t there, a false altitude, or a cloned identity. Researchers have demonstrated exactly this in controlled settings for over a decade. The vulnerability is real, and the system’s designers knew the tradeoff they were making.

But the distance between a lab demonstration and a hazard in the National Airspace System is enormous, for several reasons:

Transmitting is loud and illegal. Broadcasting on aviation frequencies is a federal crime, tightly monitored, and a transmitter announces itself - it can be direction-found. This is no longer a passive receiver.

ADS-B is not the only sensor. Controllers still have radar underneath. Many areas also use wide area multilateration, which times the same signal arriving at multiple ground stations to compute position independently. A fake single-source transmission doesn’t geometrically add up across all those receivers. A phantom that appears on ADS-B but on no radar, with no coherent multilateration solution, raises flags rather than earning a clearance. The system was built layered precisely because no single sensor is trusted absolutely.

In the cockpit, ADS-B In is an aid, not a command. It doesn’t steer you. Your eyes, your collision-avoidance logic, and the controller remain in the loop. A spoofed target is a nuisance and a research paper - not, today, a demonstrated way to bring down an airliner.

Why Wasn’t Authentication Designed In From the Start?

This is a genuinely hard engineering tradeoff, not an oversight by fools.

Cryptographic authentication needs key management - infrastructure to distribute, rotate, and revoke keys across a global fleet of hundreds of thousands of aircraft from a hundred countries. It adds message overhead to a bandwidth-limited datalink. And it has to keep working for a forty-year-old airframe with a box installed in 2019.

Retrofitting trust onto an open, worldwide, backward-compatible broadcast standard is one of the hardest problems in the field. There’s ongoing research - layering lightweight signatures, or using the physical characteristics of the transmission itself as a fingerprint - but none of it is deployed at scale. The realistic timeline for authenticated ADS-B across the world fleet is measured in many years, if it happens at all. Be skeptical of anyone promising it soon.

Who Builds the Pieces of This System?

The FAA and its contractors run the ground network and the mandate.
Avionics makers - Garmin, Avidyne, uAvionix, and others - build the boxes in your panel.
The FAA also provides the privacy tooling, PIA and LADD.
The public builds the open receiving side - thousands of volunteers with small radios feeding the tracking networks. Depending on which end of the antenna you’re standing on, that’s either wonderful or unsettling. It’s both.

The Tradeoff You’re Actually Flying With

We tend to treat ADS-B as a black box that just works - and it does. But the reason it works - the openness, the self-reporting, the cheap ubiquity - is exactly the reason it exposes you. That’s not a flaw someone can patch out next Tuesday. It’s the deep tradeoff baked into a system that chose to broadcast in the clear so it could be cheap, universal, and reach into every valley in the country.

You got the coverage. The openness was the price. Understanding that tradeoff is the difference between trusting your panel blindly and knowing exactly what it’s telling the world about you.

Key Takeaways

ADS-B broadcasts position, altitude, velocity, and identity roughly twice per second with no encryption and no authentication - by design, not by defect.
The US uses two links: 1090 MHz Extended Squitter for airliners and 978 MHz UAT for much of general aviation; ADS-B Out has been mandatory in Class A, B, and C airspace since January 1, 2020.
Privacy is the real, everyday risk. FAA tools like PIA and LADD hide you from mainstream trackers but cannot stop a $20 SDR receiver hearing you directly.
Spoofing is real in principle but heavily mitigated by radar, wide area multilateration, and the fact that transmitting is loud, direction-findable, and a federal crime.
Authentication wasn’t an oversight - it’s an unsolved global key-management problem, and authenticated ADS-B is realistically many years away, if it arrives at all.