[00:00.000 --> 00:02.380]  A survey of UAV hacks and exploits.
[00:02.540 --> 00:04.820]  We present Trevor Timm and Parker Higgins.
[00:11.680 --> 00:12.260]  Thanks.
[00:13.180 --> 00:19.420]  So, in December of 2008, after apprehending an alleged militant, U.S.
[00:19.900 --> 00:23.000]  military personnel in Iraq discovered a problem they couldn't quite figure out.
[00:23.620 --> 00:29.200]  A laptop on the suspect contained video files of aerial surveillance footage of the area.
[00:29.340 --> 00:31.880]  It seemed to be the same type of footage that the U.S.
[00:32.100 --> 00:33.380]  was capturing via drones.
[00:34.000 --> 00:36.100]  And they didn't know exactly where it came from.
[00:36.560 --> 00:37.300]  But U.S.
[00:37.380 --> 00:39.760]  investigators had evidence that this wasn't a one-time deal.
[00:40.860 --> 00:47.920]  So then, about six months later, in July of 2009, the military started finding more drone videos on other militant laptops.
[00:49.880 --> 00:50.360]  Sorry.
[00:51.240 --> 00:52.360]  So... oh, there we go.
[00:53.820 --> 00:55.560]  Most of the evidence found in Iraq...
[00:56.380 --> 01:02.720]  Most of the evidence was found in Iraq, but then they started finding drone video feeds on militants in Afghanistan as well.
[01:02.720 --> 01:08.600]  And so, officials eventually concluded that they were regularly intercepting these feeds, sometimes in real time.
[01:09.480 --> 01:12.400]  But given we would assume that the U.S.
[01:12.560 --> 01:24.400]  operates the most sophisticated drone technology in the world, and they have virtually an unlimited budget to stop hackers, you would think that they wouldn't run into these problems.
[01:24.400 --> 01:31.520]  So, what was this sophisticated technology that these supposed insurgent super geniuses were using to get all this top-secret footage?
[01:32.060 --> 01:36.620]  Well, it turns out they were using off-the-shelf software that you can buy for $26.
[01:39.300 --> 01:45.900]  So, this is called Sky Grabber, which at the time you could buy for $29.95 on this...
[01:45.900 --> 01:47.060]  It's a Russian company.
[01:47.380 --> 01:58.120]  And what it does usually is it intercepts and assembles data from satellite networks, and people use it to pick up movies or music or even pornography.
[01:58.120 --> 02:08.420]  But the Iraqi militants found out that they could intercept these large files being transmitted from the drone pilot to the actual vehicle.
[02:09.780 --> 02:12.660]  And what had happened was the U.S.
[02:12.780 --> 02:16.540]  was actually using an unencrypted communications link between the drone and the pilot.
[02:18.580 --> 02:23.200]  And it turns out they had actually known about this problem for more than a decade.
[02:23.560 --> 02:28.120]  They had a drone... they first started using drones in Bosnia in the 1990s.
[02:28.280 --> 02:32.580]  But the Pentagon assumed that local adversaries wouldn't figure out how to exploit it.
[02:36.360 --> 02:45.920]  So, you know, these militants hacked these drones basically like somebody hacking my Facebook feed if I was to leave it logged in at the Apple store.
[02:48.840 --> 02:52.600]  And so, why didn't they fix this when they knew about it for more than a decade?
[02:52.840 --> 02:54.580]  Well, they said it would cost too much.
[02:55.540 --> 02:58.120]  And that it would cause delays in their bombing campaigns.
[02:58.420 --> 03:02.100]  So, they decided just to leave it be and hope nothing went wrong.
[03:03.380 --> 03:05.860]  And so, the Wall Street Journal reported this a couple years ago.
[03:06.060 --> 03:07.740]  And they concluded like this.
[03:07.920 --> 03:13.500]  They said additional concerns remain about the vulnerability of the communication signals to electronic jamming.
[03:13.720 --> 03:15.600]  Though there's no evidence that that's occurred.
[03:16.580 --> 03:18.340]  So, cut to two years later.
[03:21.290 --> 03:25.670]  So, in December of 2011, Iran claimed to have taken down a U.S.
[03:25.770 --> 03:27.490]  drone in Iranian airspace.
[03:27.730 --> 03:32.490]  And they did this not by shooting it out of the sky, but with their cyber warfare team.
[03:33.210 --> 03:36.370]  Now, this drone is known as an RQ-170.
[03:36.610 --> 03:41.810]  And it's a stealth surveillance drone that's one of the most top secret and sophisticated in the U.S. arsenal.
[03:42.150 --> 03:45.890]  Just to give you an idea of the kind of technology we're talking about.
[03:47.230 --> 03:52.450]  The U.S. reportedly used one of these RQ-170s to spy on Osama bin Laden's hideout in Pakistan before he was killed.
[03:55.510 --> 03:59.750]  So, U.S. officials came out with statements that the drone was flying over Afghanistan and that it belonged to the army.
[04:00.250 --> 04:01.970]  But that wasn't entirely true.
[04:05.330 --> 04:10.790]  Just days after the first story, U.S. officials were forced to admit that the drone was piloted by the CIA and that it was flying surveillance missions over Iran.
[04:11.730 --> 04:13.850]  But then they insisted that it didn't get hacked.
[04:13.950 --> 04:16.350]  That they just lost control and it was a mechanical malfunction.
[04:17.430 --> 04:26.150]  So, notwithstanding the Wall Street Journal article from two years prior, cybersecurity experts assured us that it was almost impossible for these drones to be taken down remotely.
[04:27.150 --> 04:32.750]  And so, we've got a quote from cybersecurity expert James Lewis who worked in the Reagan administration.
[04:32.750 --> 04:40.250]  And he said, Iran hacking into these drones is about as likely as an ayatollah standing on a mountaintop and using thought waves to bring it down.
[04:40.750 --> 04:43.510]  The most likely explanation is that it crashed on its own.
[04:51.250 --> 04:56.050]  So, given that the drone crash landed in the Iranian desert, you'd expect that the U.S. would shortly release photos of the wreckage, of drone pieces strewn across the landscape.
[04:56.830 --> 04:59.210]  Well, actually, Iran is the one who released the picture.
[04:59.450 --> 05:01.590]  And here's the crashed drone completely intact.
[05:04.610 --> 05:10.630]  In the same report, Lewis also said, if you could hack into a drone, you wouldn't use it for some spontaneous fun.
[05:10.950 --> 05:12.630]  You'd save it for a rainy day.
[05:13.130 --> 05:15.950]  You need to be able to hack either the control network in the U.S. or a satellite.
[05:17.470 --> 05:20.230]  Neither is easy and both are probably something the Iranians can do.
[05:21.110 --> 05:22.710]  Probably not something the Iranians can do.
[05:24.250 --> 05:29.410]  So, notwithstanding Lewis's sort of funny idea of a rainy day, let's come back to that.
[05:30.190 --> 05:35.730]  If the Iranians can't hack the ground network or the satellites, how did that drone end up coming down?
[05:37.550 --> 05:40.170]  Well, that's one of the questions we plan to address during this talk.
[05:40.170 --> 05:42.790]  First, I want to do some quick introductions.
[05:43.670 --> 05:46.750]  My name is Parker Higgins, and this is Trevor Timm.
[05:47.470 --> 05:49.990]  And we're both activists for the Electronic Frontier Foundation.
[05:50.770 --> 05:58.330]  Together, we also operate the At Drones Twitter feed, which is dedicated to spreading news and views about drones at home and overseas.
[05:59.330 --> 06:10.250]  The EFF is probably familiar to most of you for some of our other work, but recently we've been paying a lot of attention to the situations with drones, and especially domestic drones.
[06:11.130 --> 06:21.490]  And so, we're going to save time for questions, but for the next half hour or so, we'll be explaining how widespread drones are today and how the number of them is set to explode in the next couple of years.
[06:21.490 --> 06:34.250]  Then we'll talk a bit about what sorts of security systems and problems that military and civilian drones are facing today, how some of these might be resolved in the future, and how some of them have already been exploited.
[06:35.270 --> 06:44.990]  Finally, we'll turn the tables for a bit and talk about the role of drones, and especially amateur drones from the DIY sector, in exploiting other vulnerabilities.
[06:46.690 --> 06:54.970]  So, I guess we'll take a step back here for a second and talk about exactly why these drone vulnerabilities are so important, and just how expansive drone use is.
[06:55.130 --> 07:02.290]  So, in a recent congressional report, the military revealed it has about 7,500 drones right now.
[07:02.470 --> 07:05.830]  This number came out a couple months ago, and it's probably already out of date.
[07:06.170 --> 07:10.950]  The most popular drone the Army has is called a Raven, which you can see here.
[07:11.730 --> 07:18.130]  They have over 5,000 of them, and you can see that they take off by having someone in the Army throw them in the air.
[07:19.370 --> 07:26.390]  But the most... and so, nearly one in three drones, or one in three planes in the Air Force right now are drones.
[07:26.670 --> 07:28.630]  And just a couple years ago, it was 5%.
[07:29.910 --> 07:35.750]  And in the next year or so, they will actually start training more pilots to fly drones than actual manned aircraft.
[07:37.170 --> 07:45.130]  So, the drone that everybody is familiar with is called the Predator, which is being used in Pakistan and Yemen and elsewhere.
[07:45.390 --> 07:49.650]  And then the Reaper, which is the Predator's bigger, better armed brother.
[07:52.190 --> 08:01.870]  And so, the Pentagon is also... just to give you an idea of how vital these are to what they consider important military missions.
[08:01.870 --> 08:07.070]  They're considering giving bravery medals to drone pilots who operate thousands of miles from combat zones.
[08:08.230 --> 08:16.050]  So, not only have they been regularly used in Afghanistan, Iraq, Pakistan, there's now a sustained bombing campaign going on in Yemen.
[08:16.870 --> 08:27.110]  And so, the New York Times now famously reported about a month ago about President Obama's kill list, where the President essentially assigns death warrants for terror suspects in the region.
[08:27.110 --> 08:28.930]  And some have included U.S. citizens.
[08:29.730 --> 08:34.550]  And so, actually, in Yemen and Pakistan, the bombing has expanded so broadly.
[08:35.430 --> 08:43.210]  They're not just targeting high-value terrorist targets, but also low-level operatives with what are known as signature strikes.
[08:43.750 --> 08:47.430]  And signature strikes are when they don't actually have intelligence on the ground.
[08:47.430 --> 08:49.910]  They're using evidences of patterns of life.
[08:50.170 --> 08:55.090]  And so, amazingly, many times, they don't even know the identity of who they're killing.
[08:56.050 --> 09:00.390]  And so, multiple drone strikes in the last few years have been reported in Somalia.
[09:00.990 --> 09:03.930]  And the New York Times actually confirmed that the U.S.
[09:04.010 --> 09:06.570]  has been conducting drone strikes in the Philippines as well.
[09:07.030 --> 09:13.090]  And they've been operating surveillance programs across the Horn of Africa and now the Caribbean.
[09:14.850 --> 09:16.370]  But you would think the U.S.
[09:16.410 --> 09:21.430]  has a monopoly on drones, and that's actually not true, not even close.
[09:21.430 --> 09:24.270]  There's actually more than 50 countries have drones now.
[09:24.910 --> 09:27.370]  And the New York Times said that that number is rising every month.
[09:28.470 --> 09:31.830]  But you would think of this problem normally as an overseas problem.
[09:32.350 --> 09:34.730]  But actually, drones are about to invade the U.S.
[09:34.930 --> 09:36.570]  more than any other country in the world.
[09:37.250 --> 09:41.730]  Right now, actually, the Predator drones without the missiles are operating on the U.S.
[09:41.750 --> 09:45.290]  and Canadian borders by Homeland Security, and have been for a couple years.
[09:45.870 --> 09:50.710]  But the FAA is actually authorizing local police agencies to use drones.
[09:51.390 --> 09:57.070]  They were keeping this list secret, the amount of authorizations they had already issued.
[09:57.250 --> 10:06.230]  But we at EFF filed a Freedom of Information Act lawsuit a few months ago, and they were forced to release a list of over 60 public agencies that already have them.
[10:07.090 --> 10:09.090]  But again, that number is about to explode.
[10:09.970 --> 10:25.610]  Congress, thanks to a clause written and inserted by the drone industry in a bill in February, actually mandates that the FAA give out licenses to any public agency that wants them, as long as they can prove that they can fly them safely.
[10:26.350 --> 10:34.150]  And on top of that, Homeland Security is spending millions of dollars on a program to facilitate and accelerate the use of drones by local police.
[10:34.750 --> 10:41.930]  And so the FAA actually estimates there may be as many as 30,000 drones in the air by the end of the decade, just in the U.S. alone.
[10:43.590 --> 10:45.510]  So what exactly do we have to worry about?
[10:46.530 --> 10:47.390]  What can these do?
[10:47.870 --> 10:50.990]  Well, in the U.S., they're not going to be shooting missiles, at least the military kind.
[10:51.910 --> 10:54.310]  But they will come in all shapes and sizes.
[10:54.570 --> 10:56.610]  They'll be able to fly for hours or days at a time.
[10:57.370 --> 11:04.930]  Some of the military drones can scan entire cities at one time, or alternatively zoom in and read a milk carton from 60,000 feet.
[11:05.790 --> 11:10.190]  They can be equipped with facial recognition software, crack into Wi-Fi networks.
[11:10.990 --> 11:18.970]  They can act as cell phone towers, intercept phone calls and text messages, or lock into your GPS and your cell phone.
[11:18.970 --> 11:27.530]  A Texas sheriff actually expressed interest in sawing what he calls less lethal weapons, like tasers and rubber bullets, for crowd control.
[11:27.930 --> 11:34.490]  And the manufacturers actually freely admit that these drones are made to hold those types of weapons for use in the U.S.
[11:36.510 --> 11:39.190]  So, now we understand how widespread drones are.
[11:39.370 --> 11:45.350]  It might be helpful to go into some of the explanations of what different groups of people mean when they say the word drones.
[11:45.350 --> 11:55.550]  So, one very specific definition comes from the FAA in Congress, who use the term unmanned aircraft system.
[11:55.890 --> 12:06.490]  And according to that definition, unmanned aircraft are any aircraft that operate without the possibility of human intervention from within or on the aircraft itself.
[12:07.010 --> 12:11.710]  And an unmanned aircraft system is the aircraft and all the associated elements.
[12:11.910 --> 12:13.130]  So, the ground station and such.
[12:13.670 --> 12:19.350]  This is a very broad definition and includes everything from RC planes to full-on predators.
[12:20.370 --> 12:25.650]  One minor distinction they have is they use the term SUAS, which is a smaller system by the same name.
[12:25.790 --> 12:28.870]  And anything lighter than 55 pounds is considered an SUAS.
[12:30.970 --> 12:40.010]  Then there's also sort of the classic robotics definition, which is best articulated by scholars like Ryan Calo at the University of Washington Law School, who does a lot of great writing on drones.
[12:40.870 --> 12:46.290]  By their definition, drones are unmanned aircraft that have the particular quality of autonomy.
[12:46.650 --> 12:57.470]  So, that rules out most remote control line of sight, like hobby planes, but includes the sorts of military and surveillance drones that you might read about in the paper.
[12:58.350 --> 13:04.610]  And in fact, speaking of autonomy, there have been efforts within the military to make the drones seem even more autonomous.
[13:05.070 --> 13:20.990]  One Pentagon initiative is working on redesigning the control mechanisms so that the operators, who are on the ground in Nevada or New Mexico, controlling strikes some 10,000 miles away, might get to assign more of the blame to the drones itself and be less affected by the trauma of war.
[13:21.490 --> 13:23.810]  Sort of a Siri kill this guy kind of thing.
[13:26.310 --> 13:35.490]  But for the most part, during this talk, when we're speaking about the kind of exploit that drones are vulnerable to, we're going to use a third definition, one that's more expansive in scope.
[13:36.390 --> 13:42.290]  We include vehicles that are unmanned, whether or not they have autonomy features, and whether or not they're aerial.
[13:42.850 --> 13:46.610]  That may seem counterintuitive, because when you think of drones, it's almost always flying.
[13:48.170 --> 13:54.050]  But it lets us include some systems that have a lot of the same kinds of vulnerabilities, and that raise the same kinds of issues.
[13:54.390 --> 14:02.210]  For example, we want to talk about, you know, Google's self-driving cars, or the robot fish in submarines that are being tested in oceans around the world.
[14:03.030 --> 14:09.670]  Insect-sized nanodrones that could be deployed in swarms like this mosquito, and small navy boat drones.
[14:10.930 --> 14:22.830]  In addition, later in this talk, we'll speak to some of the different kinds of payload and systems that can be used on drones, and how those are susceptible to exploitation.
[14:23.430 --> 14:34.630]  As the prices of sensors and related hardware come down, we've seen all sorts of small computers that have been or could be mounted on a drone, with modules like GPS units or Wi-Fi cracking software installed.
[14:35.890 --> 14:43.110]  So remember the threat vectors that cybersecurity expert James Lewis was said in the story about the drone downed in Iran.
[14:43.630 --> 14:49.070]  He said that you either need to... to hack a drone, you either need to control a network in the U.S. or satellite.
[14:50.670 --> 14:52.690]  And he said this is close to impossible.
[14:52.970 --> 14:56.670]  So let's look at how actually impossible this is.
[14:58.010 --> 15:08.010]  So in October 2011, the Air Force discovered a virus had infected its fleet of Predator and Reaper drones at a military base in Nevada.
[15:08.450 --> 15:14.950]  The virus is actually logging every keystroke the pilots made as they flew from Afghanistan and Iraq.
[15:15.310 --> 15:23.210]  Now they claim that the virus didn't prevent them from running any missions, or that no information had been lost or sent to an outside source.
[15:23.870 --> 15:27.890]  But the virus had actually resisted multiple efforts to remove it from the computers.
[15:27.890 --> 15:31.130]  And here's the money quote that they told Wired.
[15:31.350 --> 15:33.930]  We kept wiping it off, and it just keeps coming back.
[15:36.010 --> 15:41.210]  And so the Air Force ultimately determined, at least publicly, that the virus was benign.
[15:41.430 --> 15:44.790]  You know, one of those benign key loggers that we always hear about.
[15:47.940 --> 15:54.860]  So what's crazier is that the drone base actually knew about the virus for two weeks and didn't even tell the Air Force's cybersecurity team.
[15:54.860 --> 15:57.640]  They actually learned about it from reading Wired.
[15:59.780 --> 16:02.900]  One of the sources at Wired said, it wasn't highlighted to us.
[16:03.020 --> 16:05.720]  When your article came out, it was like, what is this?
[16:07.600 --> 16:09.680]  So what was the source of the virus?
[16:09.960 --> 16:12.540]  The military is, quote, not quite sure.
[16:13.600 --> 16:23.600]  They believed it entered at some point from the wild, and they don't know if it was specifically targeting the drones, but it entered through some other process.
[16:23.600 --> 16:27.900]  So that takes care of the first half of Lewis's quote.
[16:28.160 --> 16:29.480]  So let's take a look at the second half.
[16:30.180 --> 16:30.480]  U.S. satellites.
[16:31.940 --> 16:34.240]  They obviously can't be hacked at all.
[16:44.480 --> 16:46.500]  So in 2008, according to a recent congressional report, hackers interfered with two U.S. government satellites from a base in Norway.
[16:47.400 --> 16:58.280]  The report didn't indicate exactly what type of interference was achieved, but they did say, quote, that the hackers achieved all steps required to command the satellite.
[16:58.500 --> 17:01.060]  They never actually exercised the control, though.
[17:03.920 --> 17:11.880]  So aside from Lewis's objections, another major target for the drones is the GPS systems on board.
[17:12.780 --> 17:23.820]  I want to say now that you could easily give a whole talk on GPS insecurities, and you could get very technical, and there are some very good ones in there, but we can't go into that level of detail.
[17:24.020 --> 17:27.720]  So if you have questions, I'm around afterwards, but it's some complex stuff.
[17:27.820 --> 17:29.360]  So this is going to be a pretty high-level overview.
[17:30.760 --> 17:34.180]  First, it may be useful to draw a couple of distinctions.
[17:34.540 --> 17:39.080]  The first distinction is between jamming and spoofing a GPS signal.
[17:39.760 --> 17:42.180]  Jamming the signal is pretty much what it sounds like.
[17:42.300 --> 17:48.480]  You can overwhelm the GPS sensors with signals, so the legitimate location information from the satellites isn't able to get through.
[17:49.100 --> 17:50.480]  Spoofing is a little more complicated.
[17:50.700 --> 17:54.720]  It involves getting the GPS sensor to follow a different signal.
[17:55.700 --> 18:01.900]  So GPS sensors lock on to the strongest signal that they are receiving, and they take that to be the real signal.
[18:02.940 --> 18:15.800]  You can't just introduce a stronger signal and get the GPS to follow it, but if you can line up a strong fake signal with the real signal, and then start making them drift, you can make the GPS follow the fake signal.
[18:15.980 --> 18:19.680]  And at that point, you've totally owned the drone's location, and you can do whatever you want with it.
[18:20.720 --> 18:23.660]  The second distinction that's important to draw between...
[18:23.660 --> 18:26.640]  is between military and civilian GPS.
[18:27.220 --> 18:33.060]  So nobody's demonstrated a spoofing attack on military GPS, and the signal is encrypted, and so it may not actually be possible.
[18:33.960 --> 18:40.760]  It's worth noting Iran claims it brought down that RQ-170 with a spoofing attack, but most experts are doubtful.
[18:42.300 --> 18:48.480]  Civilian GPS is extremely vulnerable to spoofing, and both civilian and military GPS can be jammed.
[18:49.440 --> 18:54.260]  And this is really important because drones rely completely on GPS for all their navigation.
[18:54.620 --> 19:01.940]  So when you spoof the signal, obviously you can cause it to follow new orders, but when you jam the signal, it can lead to all sorts of unexpected behavior.
[19:03.220 --> 19:06.900]  Smaller drones typically don't have any sort of internal navigation system.
[19:07.360 --> 19:13.320]  So when they lose their GPS signal, they go into whatever sort of autonomous fallback mode they have.
[19:14.600 --> 19:16.140]  It's sort of an awesome name for it.
[19:16.140 --> 19:18.220]  They're referred to at this point as zombie drones.
[19:20.120 --> 19:22.180]  But it's actually a pretty scary thing.
[19:22.240 --> 19:24.780]  So we can look at some examples to see how this plays out.
[19:25.940 --> 19:31.100]  Actually, the big exciting story happened just recently, earlier this year at the University of Texas.
[19:31.780 --> 19:39.200]  GPS researcher Todd Humphreys performed the first known successful hijacking of a commercial drone.
[19:39.360 --> 19:42.500]  And he did this literally on a dare from the Department of Homeland Security.
[19:42.500 --> 19:44.920]  And he demoed it at DHS facilities.
[19:45.880 --> 19:53.360]  He used equipment that cost almost $1,000 to manufacture, and software that he and another researcher had written themselves.
[19:53.600 --> 19:55.960]  And it took him about four years to develop that software.
[19:56.780 --> 20:07.380]  And so in the demo, from a hilltop about half a mile from where the drone was operating, he was able to completely own it, convincing the drone that it was rising straight up.
[20:07.480 --> 20:13.100]  And so the drone thinks it's rising straight up, and it compensates by making a beeline right for the ground.
[20:14.380 --> 20:18.380]  So a safety pilot in this case intervened, but he had made his point.
[20:19.260 --> 20:27.660]  These commercially manufactured drones, the kind that are set to cover the sky in the next few years, are totally vulnerable to being hijacked from the ground.
[20:27.940 --> 20:30.040]  That's the one that all the police departments are going to be flying.
[20:31.360 --> 20:35.460]  The Wired article on this event gave the best advice that I've seen so far.
[20:35.840 --> 20:37.620]  Keep your head down and wear a helmet.
[20:41.140 --> 20:43.480]  So Professor Humphries is...
[20:43.480 --> 20:46.620]  Actually, if you're interested in a GPS talk, you should look up some of his.
[20:47.360 --> 20:54.820]  He's a great GPS expert, and he's still optimistic about the way that the technology can continue to develop.
[20:54.820 --> 20:59.420]  But he's clear about how significant the implications of his demo are.
[20:59.660 --> 21:04.880]  He says, I don't want to see drones coming into the national airspace before we patch this problem.
[21:06.060 --> 21:08.220]  So spoofing is one form of attack.
[21:08.580 --> 21:11.480]  But jamming requires even less sophisticated tools.
[21:11.680 --> 21:15.000]  And so as you might expect, we've already seen examples of it in the wild.
[21:16.120 --> 21:21.000]  It turns out that North Korea is one of the world's foremost jammers of GPS signals.
[21:21.000 --> 21:24.240]  And they've gotten their technology mostly from Russia.
[21:25.480 --> 21:32.040]  But they increase the strength of it so that it interferes with signals over a radius of 60 miles.
[21:32.640 --> 21:36.360]  So they've set up trucks to jam GPS by the border with South Korea.
[21:37.020 --> 21:39.220]  And it's had major real-world impacts already.
[21:39.540 --> 21:47.160]  In September of last year, the North Koreans surprised the world with more powerful GPS technologies than we'd ever seen them use before.
[21:47.160 --> 21:49.080]  And it forced a manned U.S.
[21:49.200 --> 21:53.980]  spy plane that was involved in a joint U.S.-South Korea exercise to make an emergency landing.
[21:54.600 --> 22:06.080]  And just a few months later, even more tragically, in May of this year, jammed GPS signals caused a camcopter S-100, one of these, that was being tested in South Korea to go into zombie mode.
[22:06.160 --> 22:08.500]  And it crashed into the ground control station.
[22:08.840 --> 22:16.380]  And the crash killed one of the engineers that had designed this and injured the two remote pilots who were working in the station at the time.
[22:17.160 --> 22:22.900]  And the North Korean jamming has been hard to pinpoint and address because they only use it intermittently.
[22:23.280 --> 22:29.000]  And it's interrupted over 600 civilian flights in and out of South Korea.
[22:29.240 --> 22:32.380]  But so far, the only crash it's been tied to is this drone.
[22:33.960 --> 22:35.100]  And that's not it.
[22:35.560 --> 22:42.640]  Zombie drones really have the potential to be a majorly disruptive problem, especially as more and more drones are sharing the sky with other planes.
[22:43.200 --> 22:52.120]  The Department of Defense acknowledged the problem in a recent report whose cover showed a map of our national airspace with drone stations overlaid onto a map of the flight paths currently in use.
[22:52.760 --> 22:54.100]  This is what it looked like.
[22:55.800 --> 22:59.820]  And there have already been some near misses with drones, both in the U.S.
[22:59.840 --> 23:00.620]  and overseas.
[23:02.060 --> 23:08.920]  For example, one German surveillance drone just barely missed colliding with a civilian jet over Afghanistan.
[23:09.200 --> 23:11.280]  Since it was a surveillance drone, it had a camera on it.
[23:11.480 --> 23:13.020]  And so this was the picture.
[23:17.820 --> 23:24.560]  And so after that, in May of this last year, also in Afghanistan, an American military cargo plane hit an American surveillance drone.
[23:24.720 --> 23:26.500]  And it forced it to make an emergency landing.
[23:26.660 --> 23:28.860]  It forced the cargo plane to make an emergency landing.
[23:28.960 --> 23:29.780]  The drone didn't make it.
[23:32.120 --> 23:41.600]  And traditional air traffic control systems, which have been in place for decades, they assume the presence of a pilot who's interpreting visual cues and behaving predictably.
[23:41.820 --> 23:45.300]  And so these systems just don't stand up to these drones.
[23:46.500 --> 23:51.220]  And of course, there just aren't that many options when a drone gets out of touch and no one's on board.
[23:51.980 --> 23:54.600]  There are a few more crazy examples of zombie drones in the wild.
[23:54.660 --> 23:55.560]  These are the ones we know about.
[23:56.060 --> 24:02.740]  A few years back, a Reaper flying a combat mission in Afghanistan just dropped off the grid and it had to be shot down by manned planes in the area.
[24:03.320 --> 24:05.240]  The Reaper, by the way, we showed it before.
[24:05.240 --> 24:06.540]  It's one of the really big ones.
[24:06.700 --> 24:10.220]  And it's on the order of $150 to $200 million a piece.
[24:10.420 --> 24:12.400]  So it's a really expensive network dropout.
[24:14.660 --> 24:19.260]  And it's not just dangerous to whoever's in the sky or nearby on the ground.
[24:19.400 --> 24:20.560]  It's dangerous to them too.
[24:20.760 --> 24:26.580]  But these things carry all kinds of technology and data that's really bad news if it falls into the wrong hands.
[24:27.860 --> 24:32.320]  And the Predator and Reaper, they both have remote wipe functionality.
[24:32.500 --> 24:37.360]  But of course, if you lose contact with it, there's no way of knowing whether it works.
[24:38.280 --> 24:46.120]  So in another example, back in summer of 2010, a drone went rogue over the restricted airspace in Washington, D.C.
[24:46.120 --> 24:53.760]  And this was a fire scout model about the size of a small helicopter flying around and no one knows how to control it over Washington, D.C.
[24:53.960 --> 24:58.460]  So fighter jets almost had to be scrambled to take it down, but then it just crashed on its own.
[24:59.820 --> 25:03.980]  So GPS attacks are a major problem, and they're only poised to get worse.
[25:05.080 --> 25:11.980]  But before we move on to the section, there's one other vector by which a drone can get owned, and it's sort of unique to this, it's physical attacks.
[25:12.900 --> 25:17.700]  As you can imagine, the physical access problem is pretty severe with drones.
[25:18.360 --> 25:20.240]  For one thing, they're not very fast.
[25:20.500 --> 25:28.140]  The Predators and Reapers that we showed before, they seem menacing for sure, but they max out at about 100 miles per hour or about as fast as one of these.
[25:31.520 --> 25:41.220]  In 1999, during the NATO bombings of Yugoslavia, there were drones in the air, and the Serbian air defense destroyed at least 15 of them.
[25:42.000 --> 25:52.240]  There's one report from then that's been repeated a lot, it's never been officially confirmed, that one of these drones was destroyed in a scene that sounds like it just has to come from an action movie.
[25:52.500 --> 25:57.740]  It was shot down with a machine gun fired from the open door of a helicopter hovering next to it.
[26:00.740 --> 26:08.180]  So, there haven't been too many instances yet of drone dogfights with manned vehicles, but the picture doesn't look pretty for them.
[26:09.300 --> 26:22.260]  Just as one other example, Charles Krauthammer, who's a conservative American columnist, he's gone on the record against drones in the U.S., and his opposition might be an indicator of how much of the public feels.
[26:22.900 --> 26:36.680]  He said, I would say that you ban it under all circumstances, and I would predict, I'm not encouraging, but I'm predicting that the first guy who uses a second amendment weapon to bring a drone down that's been hovering over his house is going to be a folk hero in this country.
[26:45.140 --> 26:57.140]  So, finally, we do want to take as many questions as we can, but with the rest of the time we have before we open the floor, we do want to mention some of the cool ways that drones have been used in other exploits, and some of the less cool ways, too.
[26:58.340 --> 27:06.660]  So, the use of drones opens the door to mounting traditional attacks in manners that build in a pretty exciting way.
[27:08.000 --> 27:16.920]  In some of these cases, there's not a lot new going on technically, but there's definitely a gee whiz factor, because it's mounted on a flying death machine.
[27:18.420 --> 27:33.320]  So, the first thing to understand is that while most of the drones being used by police stations in the military are very expensive, and they range from tens of thousands of dollars for a low-end police model to hundreds of millions for the big predator-style beasts,
[27:33.820 --> 27:38.780]  there's an active community working on hacking inexpensive drones and even making them from scratch.
[27:39.380 --> 27:44.720]  So, popular models like the Parrot AR drone, they're just a few hundred dollars.
[27:44.900 --> 27:55.500]  They can be controlled with an iPhone or iPad, and they come with some built-in autonomy so that they can loiter or follow basic scripts if they get out of range of the controller.
[27:56.500 --> 27:59.780]  The software that it comes with even comes with a follow me button.
[28:00.060 --> 28:06.760]  So, when you hit it, you can have your own army of drones follow you with either the GPS and the controller or by locking onto you visually.
[28:07.860 --> 28:13.660]  So, off the shelf, they come with a camera that transmits video live to the control device, your iPad or your iPhone.
[28:14.100 --> 28:17.460]  And hackers have already started adding other sensors and payloads.
[28:19.060 --> 28:25.320]  And, of course, building and flying RC planes has been a popular hobby for decades.
[28:25.500 --> 28:30.840]  But what's changed is that the tech has gotten much more advanced and the sensors are way more sophisticated.
[28:31.620 --> 28:43.000]  And so, beyond these off the shelf models, there's a large and growing online community called DIY Drones that develops autonomy software and plans for building drones.
[28:44.040 --> 28:47.400]  Planes, quadrocopters that have four rotors and hexacopters that have six.
[28:47.660 --> 28:49.460]  Mostly for less than a thousand dollars.
[28:49.840 --> 28:52.360]  And these things really have the cool hacker feel.
[28:52.580 --> 28:55.000]  You know, it's all open-source hardware and free software.
[28:55.600 --> 29:01.940]  And the people who are engaging this community are really dedicated to helping advance the state of the art of amateur drones.
[29:02.660 --> 29:06.060]  It's run by Chris Anderson, who's the editor-in-chief of Wired.
[29:06.060 --> 29:11.760]  And so, he runs this forum and also the company that sells the official kits.
[29:11.980 --> 29:14.020]  But, you know, you can get the kits from anywhere.
[29:14.780 --> 29:17.420]  And he said that he's trying to kick off a revolution.
[29:18.320 --> 29:23.840]  Following in the footsteps of the PC revolution, he's trying to put the word personal into drones.
[29:25.700 --> 29:28.880]  And, of course, you know, it's not just about the construction of this vehicle.
[29:29.300 --> 29:33.020]  Once you've got that, you can put all sorts of payloads on there.
[29:33.020 --> 29:36.220]  And people in the communities have experimented with different things.
[29:36.740 --> 29:44.000]  Like, for example, one popular thing is, drones have been equipped with Wi-Fi cracking or interception software.
[29:44.460 --> 29:48.520]  So, many, many people in this room, I'm sure, know about war driving.
[29:48.980 --> 29:52.540]  Some people may have heard it for the first time with the Google Street View cars.
[29:52.920 --> 30:06.220]  But just to catch anybody else up or on the video, the idea is that by cruising through different wireless networks, and on any given block in this city, there may be hundreds of them, you can intercept data that's being transmitted in the clear.
[30:06.420 --> 30:10.660]  Or if you collect enough data, you can use it to crack some of the less secure Wi-Fi encryption protocols.
[30:11.160 --> 30:14.000]  And you can also, of course, piggyback onto an open network.
[30:14.160 --> 30:17.740]  And you can use it to transmit data that would be difficult to tie back to you.
[30:19.320 --> 30:22.420]  Typically, this is done with an open laptop in the passenger seat of a car.
[30:22.860 --> 30:27.480]  But in the past, people have experimented with war biking, war jogging, war training, and others.
[30:27.480 --> 30:32.500]  So war droning, as it might be called, has some advantages over all of these.
[30:32.880 --> 30:36.860]  Because some drone models can fly almost silently overhead.
[30:37.380 --> 30:43.780]  And they can come really down close or land on the roofs of buildings and can loiter in place for a long time and then move on.
[30:43.980 --> 30:45.240]  So it's just an example.
[30:45.380 --> 30:49.480]  But if someone wants to build a really cool one of these, I'm sure you'd get into the next hope with a talk about it.
[30:51.360 --> 30:55.900]  But once you've got network equipment on there, there are all sorts of exciting things you can do with it.
[30:56.600 --> 31:05.720]  So earlier this year, The Pirate Bay put out a press release stating that they're going to use a fleet of inexpensive drones and Raspberry Pi computers as an aerial server farm.
[31:07.720 --> 31:15.120]  The idea is that this would require future raids on their site to be conducted with a military ground-to-air assault.
[31:18.180 --> 31:21.600]  So, you know, it's hard to tell when The Pirate Bay is serious about that sort of thing.
[31:21.800 --> 31:25.520]  But other groups have experimented with running mesh networks and file servers from a drone.
[31:26.240 --> 31:28.380]  And which is, you know, it's an exciting idea, but it's scary.
[31:28.600 --> 31:36.820]  Because it sounds fun and subversive to fly drones that are, you know, for example, seeding torrents of all the acts at an outdoor music festival right above the crowd.
[31:37.380 --> 31:40.460]  But remember that Wired quote about keeping your head down and wearing a helmet?
[31:43.140 --> 31:51.360]  Anyway, you can imagine not just file servers, but mesh networks and chat servers and all sorts of location-aware services that can be deployed in the sky quickly.
[31:52.780 --> 31:54.120]  But it's not just about hackers.
[31:54.440 --> 31:56.700]  Law enforcement has some ideas for some of the uses.
[31:57.280 --> 32:07.160]  Yeah, so in the last year or two, the FBI has been using a device which many of you may have heard of called a Stingray to intercept people's cell phone location.
[32:07.400 --> 32:16.340]  And now, for a long time, we didn't know how often the police were actually using these devices or any other types of requests to get information like this.
[32:16.440 --> 32:24.520]  But it just came out last week, actually, that in the last year, there was about one and a half million requests for people's location data across the U.S.
[32:24.800 --> 32:29.320]  And this number was actually very low compared to what that real number is.
[32:29.480 --> 32:31.660]  And partly, it's because of these stingrays.
[32:32.660 --> 32:36.700]  So what a Stingray does is essentially mimic a cell phone tower.
[32:37.360 --> 32:40.980]  It gets a phone to connect to it, and it measures signals from the phone.
[32:41.700 --> 32:50.540]  You know, your cell phone pings back a signal to cell phone towers every seven seconds and gives whoever's looking at a precise location of where you are.
[32:50.780 --> 32:54.100]  Or if it's you, you can see where you are on your phone.
[32:54.980 --> 33:01.600]  Now, these devices have various uses, but they've mainly been used by police to locate suspects.
[33:01.600 --> 33:04.080]  And all of this is done without a warrant.
[33:04.980 --> 33:06.980]  So it's essentially a fake cell phone tower.
[33:07.820 --> 33:12.280]  And so now these Stingrays can be attached to drones.
[33:13.000 --> 33:25.760]  At last year's DEFCON, actually, a drone called a WASP was demoed, and it impersonated cell phone towers used by AT&T and T-Mobile to trick cell phones into connecting to it rather than a carrier.
[33:26.780 --> 33:33.280]  And it allowed the drone to record conversations or text messages and it had 32 gigabytes of storage.
[33:35.620 --> 33:49.240]  So what can we all do about all of these potential privacy violations that could be happening fairly regularly in the next few years when privacy law hasn't exactly caught up to this technology?
[33:49.580 --> 33:51.380]  Well, there's one way everyone can help.
[33:52.140 --> 34:04.300]  So although we forced the FAA to release a list of all the agencies that already have drones, unfortunately, they initially refused to say what type they are or how they were going to be used.
[34:05.020 --> 34:10.520]  So at EFF, we partnered with a group called MuckRock, which is an open government group.
[34:10.520 --> 34:12.780]  You can visit their website at muckrock.com.
[34:13.100 --> 34:27.260]  And we filed public records requests with every police agency on the list that already has one asking what they intended to do with their drone, what type it was, who was going to fly it, and we laid out all of our concerns.
[34:27.720 --> 34:31.460]  And so this only covers about two or three dozen law enforcement agencies so far.
[34:31.560 --> 34:37.220]  But like I said, there is going to be thousands and thousands of drones in the sky in the next few years.
[34:37.760 --> 34:40.520]  And there's 19,000 police agencies in the U.S.
[34:41.280 --> 34:49.760]  So what you can do is you can go to muckrock.com, and you can fill out a simple form yourself, and they will file a public records request for you.
[34:49.940 --> 34:58.820]  You just enter in your local police agency's contact information, and you can follow along on the screen as it progresses.
[34:59.740 --> 35:04.420]  So you can actually help us map how these drones are being used.
[35:04.660 --> 35:19.820]  And then we're going to tell people, once we have all this information compiled, how they can go to their local city council or their municipal government or state government or Congress to try to get binding ordinances of laws passed that can prevent drone surveillance before it gets out of control.
[35:21.120 --> 35:31.320]  So one of the reasons that we've been tracking drones at EFF is because of all of the sort of obvious privacy questions that are raised by constant overhead surveillance.
[35:31.700 --> 35:34.140]  But that's just the primary purpose of these machines.
[35:34.140 --> 35:40.860]  And as everybody in this room knows, you can't just look at the intended uses of technology to decide where the problems are.
[35:41.460 --> 35:49.060]  We have to look at the tools that are being developed today and not just worry about how they might succeed, but also how they might fail.
[35:50.080 --> 36:01.600]  And the principles that we push for in responsible use of technologies, things like minimizing the data collection or retention, they matter even more when we think about how vulnerable these systems may be.
[36:02.720 --> 36:07.440]  So that concludes our, you know, the prepared part of this.
[36:07.720 --> 36:10.100]  But we do have time for questions now.
[36:10.300 --> 36:13.180]  I want to thank everyone for listening to this presentation.
[36:13.740 --> 36:15.620]  And yeah, we'll open the floor to questions.
[36:15.820 --> 36:19.360]  And please come up to the mic if you've got a question so that everyone can hear.
[36:30.180 --> 36:31.420]  Okay, silly question.
[36:31.420 --> 36:36.100]  How far off do you think we are from Stevenson's toner wars?
[36:38.740 --> 36:43.200]  Well, so there are a lot of these sci-fi concepts that it's, you know, it's hard to say.
[36:43.340 --> 36:45.880]  30,000 in the sky in the next, like, couple of years.
[36:46.820 --> 36:50.480]  And then when they've got, you know...
[36:50.480 --> 36:50.900]  Trillions.
[36:50.900 --> 36:51.020]  Trillions.
[36:51.220 --> 36:51.580]  Yeah.
[36:52.720 --> 36:53.340]  And once...
[36:53.340 --> 36:54.280]  Clouds around everyone.
[36:54.860 --> 36:55.560]  Well, right.
[36:55.720 --> 37:00.140]  And when we talk about, you know, you saw the mosquito thing that we put up there.
[37:00.280 --> 37:04.980]  Like, these things are getting smaller and smaller and cheaper and cheaper and scarier.
[37:05.120 --> 37:08.660]  So, you know, I don't know how many years off we are from trillions of drones.
[37:08.660 --> 37:16.280]  So, just as an example, there was a video that was just released last week about what's called a maple seed drone.
[37:16.420 --> 37:21.200]  It's basically in the shape of a maple seed and just a little bit larger, which Lockheed Martin makes.
[37:21.560 --> 37:30.000]  And they, during the video, the public relations guy was, just imagine dropping thousands and thousands of these out of an airplane.
[37:30.840 --> 37:32.940]  So, these are closer than you would think.
[37:33.360 --> 37:35.060]  I just want to put in a plug for...
[37:35.060 --> 37:39.080]  We didn't have time to put in our presentation because it was just announced yesterday, the day before.
[37:39.300 --> 37:51.680]  But my favorite crazy sci-fi concept that is in practice now is that Lockheed Martin has demonstrated charging their drones while they're airborne via laser from the ground.
[37:51.900 --> 37:54.400]  And allowing it to stay up indefinitely.
[37:54.620 --> 37:58.220]  They did a test for 48 hours, but it just, you know, they kept charging it.
[37:58.320 --> 37:59.840]  So, you can look that up.
[37:59.940 --> 38:01.360]  That is, like, insanity.
[38:02.520 --> 38:06.420]  I just wanted to very quickly add to your comment about the physical access to drones.
[38:06.560 --> 38:08.040]  It seems to be a surprise to people.
[38:08.520 --> 38:10.300]  Because they've been doing this for 70 years.
[38:10.460 --> 38:15.720]  In World War II, RAF pilots who didn't want to waste the ammunition on a V1 would come up beside it.
[38:15.760 --> 38:16.460]  They'd flip the wing.
[38:16.600 --> 38:20.860]  If you got the gyroscope past 90 degrees, it would think up was down, and they would just nose-dive into the ground.
[38:21.100 --> 38:22.760]  So, it's, why is this a surprise?
[38:22.760 --> 38:24.720]  It was just stunning to me that people are still amazed.
[38:25.180 --> 38:25.520]  Yeah.
[38:25.960 --> 38:32.520]  It's, I mean, with a lot of these, we feel like, well, it must be so advanced, because it's, you know, the front line of what we're using on there.
[38:32.680 --> 38:37.720]  But, yeah, there's a lot of these sort of simple questions that we don't have answers to.
[38:39.020 --> 38:39.360]  Hi.
[38:39.440 --> 38:41.440]  So, I'm wondering about sort of the flip side of it.
[38:41.520 --> 38:46.620]  As these become cheaper and so forth, do you guys see, like, legitimate uses for drones in journalism?
[38:46.620 --> 38:52.860]  And how do we sort of leverage drones in the drone wars from our side against that?
[38:52.920 --> 38:53.060]  Yeah.
[38:53.120 --> 38:58.060]  It's not a necessarily a completely bad thing, this new technology.
[38:58.060 --> 39:01.520]  It's scary in the surveillance sense that it can be used by law enforcement.
[39:01.660 --> 39:04.860]  But, of course, like you mentioned, there are definitely legitimate uses.
[39:05.640 --> 39:06.920]  Journalism being one.
[39:07.200 --> 39:13.240]  Another being mapping natural disaster areas that can't be accessed by humans.
[39:13.240 --> 39:20.820]  Actually, you know, we talk about the stingray and the fake cell phone tower that can be attached to drones, but they can also attach real cell phone towers.
[39:21.000 --> 39:30.180]  So, in a hurricane situation or tornado or earthquake, when cell phone towers get destroyed, drones can fly over and give people better access to communications.
[39:30.700 --> 39:34.980]  Actually, the FCC is already planning on doing this, at least.
[39:35.860 --> 39:38.640]  So, you know, it's definitely a double-edged sword.
[39:39.440 --> 39:52.060]  And we're not advocating banning drones entirely, but the chances of abuse for police officers, if they can use these without any sort of regulation, is, you know, almost 100%.
[39:53.380 --> 39:58.520]  Well, just kind of following up with what you said, I think the real thing about that is without regulation.
[39:58.700 --> 40:07.600]  One of the interesting points I found was that one of the first times that the police department appeared in the news, to my knowledge, association with drones, was actually a few years ago with LAPD.
[40:07.820 --> 40:10.840]  They put the first request in to have a military drone.
[40:11.160 --> 40:18.140]  Their specific use was actually primarily as search and rescue ops for the mountainous area and the forest area nearby.
[40:18.480 --> 40:26.840]  They were saying that they were losing... they actually couldn't find people being lost there, just because there wasn't enough man hours they could possibly put up in the air for people to go search it.
[40:26.900 --> 40:29.240]  So they really wanted drones to help do that.
[40:29.240 --> 40:36.880]  The Supreme Court shot it down at the time, saying that it was a violation of privacy, but that was the first nationwide connection between police and drones.
[40:37.000 --> 40:38.000]  So there are good things there.
[40:39.140 --> 40:39.580]  Absolutely.
[40:39.840 --> 40:47.340]  And the quote in the robotics community is that these are good for jobs that are too dull, dirty, or dangerous for humans.
[40:47.680 --> 40:52.080]  And there are certainly plenty of those tasks that drones perform better and cheaper.
[40:52.340 --> 40:58.960]  And so, you know, most of the regulations that we've seen introduced are, you know, you need a warrant for this sort of thing.
[40:58.960 --> 41:01.020]  And that seems sane to me.
[41:01.180 --> 41:01.320]  Yeah.
[41:01.500 --> 41:04.580]  And, you know, another great example, putting out forest fires, for example.
[41:05.240 --> 41:11.120]  You know, drones are 10s, 20 times cheaper than flying helicopters.
[41:11.380 --> 41:14.820]  You know, flying helicopters cost $3,000 an hour.
[41:14.980 --> 41:16.840]  Drones cost $50 or $100 an hour.
[41:17.040 --> 41:21.080]  So there are, like you said, there are definitely legitimate uses.
[41:21.420 --> 41:28.140]  And, you know, we're not advocating a total ban, but it's about precautions and safeguards.
[41:28.140 --> 41:30.060]  No, that was sad.
[41:30.200 --> 41:37.280]  I wanted to ask one thing that I came up for was that, now, just to play a bit of devil's advocate regarding the Iran taking down the drone.
[41:37.540 --> 41:46.780]  The one thing that I found kind of interesting was that I went online and tried to find actually people I know that worked in the aerospace industry.
[41:47.000 --> 42:04.600]  And their response was that one of the ways that drones self-destruct is they wipe all the electronic data, fry all the electronic circuitry and sensors, and then pitch themselves up into a high angle of attack, which would then presumably stall the plane and have it crash into the ground.
[42:04.600 --> 42:08.420]  So they don't primarily aim at the ground, but they would be falling from that height.
[42:08.680 --> 42:14.000]  Now, one of the things that was interesting was, happened in the USSR and also in Russia.
[42:16.180 --> 42:35.520]  Plane was... in USSR, it was a pilot had lost control of the plane in a dive, and then ejected from the plane, and then the plane stabilized, and I think it actually made it from Russia all the way to Belgium before crashing in Belgium.
[42:35.820 --> 42:50.640]  They can do that, and actually the U.S. had an even more interesting one where, after the pilot ejected and the plane was also out of control, the plane stabilized and landed nearly completely 100% intact with no damage in the middle of the field.
[42:51.080 --> 43:04.140]  Like, I'm just saying, just because the plane... they thought this was... they had this whole self-destruct thing primarily set up, like, you know, where it would pitch up, it is possible and has been proven to happen where the plane does land safely.
[43:04.160 --> 43:07.980]  So I'm saying... I'm playing devil-good-the-affrican and saying that it could be true.
[43:08.100 --> 43:09.700]  Yeah, I mean, that's kind of what we were saying, too.
[43:09.780 --> 43:16.580]  We weren't saying for sure that they had actually taken it down via taking complete control of it.
[43:17.160 --> 43:19.560]  It's likely that that sort of situation happened.
[43:19.680 --> 43:22.840]  And that's where the kind of the zombie drone, which Parker was talking about, comes into play.
[43:23.280 --> 43:26.700]  They could have jammed the GPS and the U.S. could have lost signal with it.
[43:26.780 --> 43:35.100]  And then it could have gone into this sort of remote mode that kind of tells it to land without actually anybody telling it to.
[43:37.540 --> 43:44.000]  To what extent are law enforcement agencies using this to intercept cellular communications?
[43:44.460 --> 43:48.420]  And do we know, like, what sort of data they're looking for?
[43:48.520 --> 43:54.200]  Are they doing just mass gathering of information and network mapping?
[43:54.200 --> 43:57.300]  Or are they looking at specific calls?
[43:58.140 --> 44:00.320]  And have there been any case law around this?
[44:00.320 --> 44:07.980]  Yeah, I mean, there are no confirmed cases of local police officers actually using drones to intercept cell phones.
[44:08.160 --> 44:08.180]  Or national.
[44:08.860 --> 44:09.100]  Sorry?
[44:09.280 --> 44:10.160]  Or federal.
[44:10.400 --> 44:11.020]  Right, right.
[44:11.700 --> 44:14.880]  We know it has this capability and they have been engaged.
[44:15.120 --> 44:21.680]  Like I was saying earlier, it just came out, all the cell phone companies just released how many demands they get from law enforcement each year.
[44:21.820 --> 44:36.940]  And a lot of times, like you alluded to, these demands may be for one person, but they come in the form of cell tower dumps where the police get the location information of everybody around that cell phone tower for a certain amount of time.
[44:37.080 --> 44:38.760]  And that could be hundreds or thousands of people.
[44:38.940 --> 44:45.300]  And most, a vast, vast majority of them aren't the actual person the police are looking for, but they still get this information.
[44:45.300 --> 44:48.820]  So it's really a huge privacy concern.
[44:49.180 --> 44:55.480]  And this just gives them another weapon, so to speak, in their arsenal to gather this information.
[44:55.480 --> 45:09.020]  But to specifically answer confirmed cases, we haven't seen confirmed cases, and my personal hunch is that we probably won't as long as it's as easy to get the data from the phone companies as this report shows.
[45:09.240 --> 45:12.840]  That's just, I mean, why fly the robot when you just ask?
[45:13.040 --> 45:13.160]  Yeah.
[45:14.300 --> 45:14.680]  Thank you.
[45:17.360 --> 45:17.880]  Hi.
[45:18.420 --> 45:24.460]  Tomorrow, if I wanted to DIY my own drone and start flying it over Wilmingensburg, Brooklyn, could I do that?
[45:24.460 --> 45:26.000]  Is there any law on braking?
[45:26.300 --> 45:27.900]  Is there any airspace regulations?
[45:28.500 --> 45:29.460]  Line of sight.
[45:29.640 --> 45:31.060]  Yeah, it's line of sight.
[45:31.220 --> 45:36.780]  I mean, it's basically the same sort of lack of regulation that allowed RC planes.
[45:37.060 --> 45:42.660]  And truthfully, you know, we've gone to some of these fly-ins where people are flying these drones.
[45:42.820 --> 45:44.740]  It looks like a bunch of guys flying RC planes.
[45:44.740 --> 45:51.100]  Like, sometimes they say, hey, check this out, and they show, and they, you know, set waypoints, and it flies itself around those waypoints.
[45:51.500 --> 45:55.580]  But, you know, from the ground, it just, it doesn't seem different from people with drones.
[45:55.580 --> 46:01.100]  Yeah, as long as it's below 400 feet, and I believe it can't be a populated area, so you can't do it in the middle of a city.
[46:03.200 --> 46:06.420]  But it's, like Parker said, it's those types of regulations.
[46:06.760 --> 46:08.240]  And you can't do it commercially either.
[46:08.400 --> 46:08.760]  That's the only...
[46:08.760 --> 46:10.320]  Okay, I guess then, second quick question.
[46:10.460 --> 46:17.620]  At Occupy Wall Street, tracking the police movements, if I had been flying a drone and broadcasting that to a website, what would have happened?
[46:17.760 --> 46:19.660]  Do you think they would have brought it down?
[46:19.660 --> 46:23.080]  Well, so a guy did this, the Occupy Copter.
[46:23.380 --> 46:24.820]  And I think he might be here.
[46:25.340 --> 46:25.540]  Yeah.
[46:27.200 --> 46:28.000]  Is he here?
[46:28.500 --> 46:29.380]  Is Tim here?
[46:29.740 --> 46:30.140]  Anyway.
[46:31.460 --> 46:35.760]  So, and it, there hasn't been a conflict yet.
[46:35.840 --> 46:38.560]  I don't, I actually don't think that there'd be, like...
[46:38.560 --> 46:41.220]  We can't give legal advice up here anyway, so...
[46:41.220 --> 46:41.400]  Yeah, we're not.
[46:41.660 --> 46:42.460]  Okay, thank you.
[46:47.250 --> 46:47.690]  Hi.
[46:47.930 --> 46:56.530]  I'm wondering if you could speak to the use of drones, either armed or unarmed, on the nearest conflict zone in the southern border of Mexico, of the U.S.
[46:56.610 --> 46:57.050]  with Mexico.
[46:57.450 --> 47:00.450]  Yeah, so Homeland Security's been operating these...
[47:00.450 --> 47:02.910]  They have 10 predator drones, I believe, right now.
[47:03.010 --> 47:04.350]  And they've been operating for a few years.
[47:04.450 --> 47:08.630]  They spent over $250 million on them.
[47:08.810 --> 47:12.490]  And actually, a report just came out a few...
[47:12.870 --> 47:28.530]  Like a month ago, explaining how the project is just overrun with costs and how they actually haven't even been effective in what they're trying to do, which is stop undocumented immigrants from coming over the border.
[47:29.110 --> 47:33.150]  I think, I can't remember the exact number, but it was something...
[47:33.150 --> 47:37.670]  They're spending hundreds of thousands of dollars per mile per immigrant found.
[47:37.670 --> 47:40.670]  Yeah, it's mismanaged.
[47:40.810 --> 47:48.150]  The report that just came out said that they, given the amount of drones they have, they should be flying about 10,000 hours.
[47:48.350 --> 47:57.110]  They logged about 4,000 hours of flight time last year just because they've misbudgeted it and they don't have the people to control the ground station.
[47:57.110 --> 48:00.210]  So it's happening and you do hear reports of it.
[48:00.390 --> 48:06.930]  But a lot of the flight time hasn't even been strictly for Border Patrol.
[48:07.170 --> 48:08.750]  They've loaned them to other agencies.
[48:09.050 --> 48:12.170]  So are any of those other agencies involved in drug enforcement?
[48:12.730 --> 48:16.370]  I mean, against, I don't know, unpopular drug cartels?
[48:16.550 --> 48:20.130]  Well, so actually, I alluded to it, but I didn't really go into specifics.
[48:20.130 --> 48:25.350]  There was an LA Times story that came out two weeks ago that talked about how the U.S.
[48:25.410 --> 48:27.550]  is flying surveillance missions over the Caribbean.
[48:27.970 --> 48:33.110]  And in these missions, they're targeting drug lords.
[48:33.330 --> 48:34.730]  And they're just surveillance.
[48:34.930 --> 48:37.230]  They're not using missiles as we know of yet.
[48:37.450 --> 48:40.730]  But yes, that's what they're actually trying to find.
[48:40.890 --> 48:45.490]  We probably have time for one or two more questions, but it looks like there's just one person in line.
[48:45.510 --> 48:46.430]  So it's perfect.
[48:47.530 --> 48:48.170]  Hi.
[48:48.410 --> 48:53.310]  That was about June the 19th.
[48:53.310 --> 48:59.070]  I was at the Department of Defense's International Command and Control and Research and Technology Symposium.
[48:59.670 --> 49:04.530]  And while I was there, SPAWAR, I don't remember what the acronym stands for.
[49:04.650 --> 49:07.430]  I think they're for research or some government entity.
[49:07.630 --> 49:12.990]  But they gave a couple of lectures about drones and fully autonomous units.
[49:13.630 --> 49:25.410]  And the main thing that was talked about also at the whole symposium was the fact that there's an incredible information deluge going on within the government and the military.
[49:26.790 --> 49:29.310]  So the drones, you say that...
[49:29.310 --> 49:30.730]  Well, the drone itself is inexpensive.
[49:30.910 --> 49:38.070]  But it's actually more expensive overall than any other one because you're dealing with a crew of 300 plus people.
[49:38.490 --> 49:46.410]  And most of them are, in fact, information people dealing with distributing and how to figure out where this information is supposed to go to.
[49:46.410 --> 49:51.010]  So right now it's extremely expensive versus one information pilot.
[49:51.150 --> 49:57.150]  Right now they're trying to think of machine learning to try and sort through all the typically useless information of looking at the desert or whatever.
[49:57.890 --> 50:05.950]  But also another thing I wanted to put on was some of these drones have been talked about in the magazines as being weaponized.
[50:06.390 --> 50:19.250]  Whether it be those little quadcopters having tasers on them or DARPA's briefly mentioned but quieted down experimental drone called the EATR.
[50:19.250 --> 50:33.610]  E-A-T-R, if anyone ever heard of that thing, appeared in Fox News and a couple of news articles briefly a few years ago was a drone that could theoretically kill people and live off the flesh of them through a gasification unit.
[50:34.210 --> 50:38.810]  And the fuel cells would last theoretically up to 20 years according to them.
[50:38.950 --> 50:42.130]  That's still in Fox News or whatever and Huffington Post.
[50:43.070 --> 50:44.730]  Yeah, thank you for bringing that up.
[50:45.170 --> 50:48.730]  Those are... I mean, we haven't seen any eaters in the wild, but...
[50:48.730 --> 50:51.990]  There's a good future in some of this stuff, but others are just a little insane.
[50:52.310 --> 50:53.390]  We're just about out of time.
[50:53.590 --> 51:03.150]  Yeah, like you mentioned, the Air Force actually has so much footage that taking the amount of people they have looking at it, it would take more than their lifetimes to actually go through it at this point.
[51:03.830 --> 51:07.410]  And you can imagine how that's going to rise exponentially in the next few years.
[51:08.010 --> 51:09.890]  I just wanted to point out one more thing.
[51:10.050 --> 51:22.650]  If you read today's New York Times, there's actually... the FAA actually just released less than 24 hours ago a lot more information dealing with our Freedom of Information Act lawsuit against the FAA.
[51:23.030 --> 51:32.330]  And they released 18 police departments' authorizations, certificates of authorization, and they talk about what types of drones they actually have.
[51:32.510 --> 51:36.210]  I had mentioned they had initially been hesitant to release that information.
[51:36.430 --> 51:40.230]  We don't know what they're using it for, but we know now at least what some of them do.
[51:40.230 --> 51:48.290]  So, for example, the Mississippi Department of Marine Safety has a 35-ounce drone hooked up to a still and video camera.
[51:48.510 --> 52:01.710]  Or the Texas Department of Safety has the drone known as the WASP, which is actually what I mentioned, has the cell phone tower, can be built in, and that's now operating in the South Texas.
[52:02.190 --> 52:06.170]  So, if you want to read more about this, you can go on our website, EFF.org.
[52:06.170 --> 52:07.770]  It's the first blog post right now.
[52:08.270 --> 52:10.930]  Or, as I said, it should be in this morning's New York Times.
[52:11.470 --> 52:11.730]  All right.
[52:11.970 --> 52:12.730]  Thank you very much.