Hacker News Reader

Comment by dredmorbius | Hacker News Reader

If those IDs are fixed, then third parties will be able to collate identities and owners or operators over time.

Do you have any details / references on the specification?

There’s a randomization aspect to it to thwart that. The specs haven’t been finalized, but they’ve been given to ASTM to flesh out. The Federal Aviation Regulation basically spells out the requirements at this point.

I believe this is a draft [0] (it could be final too at this point). From there, here’s the specific ID randomization:

> UTM (UUID): A UTM-provided unique ID traceable to the Registration ID that can act like a “session id” to protect exposure of operationally sensitive information.

[0] https://www.reginfo.gov/public/do/eoDownloadDocument?pubId=&...

So long as the identifier is constant over time that does not matter.

From your reference:

UAS ID Type 1. Serial Number, 2. Registration ID, or 3. UTM U

(page 10)

That is: there is a single identifier, constant over time, that is assigned to each drone aircraft.

The UUID standard appears to be RFC 4122:

https://www.rfc-editor.org/rfc/rfc4122

And again: so long as that's transmitted in the clear, ANY party may accumulate a database of UUIDs and locations over time, which would tend to identify the party(ies) associated with a specific drone. That might not be precisely the operator, but if drone ID "8daf5e654951a033175fb71e0a2ecc03"[1] keeps showing up at Your Fine City's Police Department ... or sewage department, or electric utility ... you might begin to draw some inferences regarding its likely owner/operator.

It might be easier to do so if the identifier had, say, a specific entity element to it (say, as with LDAP or X.500 entity attributes), but the lack of such an element to the identifier itself is at best a small hinderance to owner/operator identification.

________________________________

Notes:

1. md5sum of the randomly-selected string "random drone id"

Is this an attack we care about preventing? You can do the same with license plates, for example.

It's been a question of interest within this thread.

https://news.ycombinator.com/item?id=30923274

I really don't mind if people can trace my drone back to me. I'm a licensed ham radio operator and my call sign is linked to my real identity. And I want to know who is flying drones over my property. The two police departments that regularly fly helos over my house use the same paint scheme as their squad cars to make it obvious who they are. They use the tail numbers N911DC (Washington DC) and N911PG (Prince George's County) for the same reason.

There’s a diversity of allowed identifiers to support different hardware. The fixed identifiers are intended for retrofit modules, since they need to have as little impact on the drone’s center of gravity as possible. Newer hardware will likely incorporate it into the receiver’s functionality.

You've made no credible representation that identifiers will be time-variable in a non-predictable manner.

Which is required to defeat any level of time-based observational collection and correlation by third parties. As is commonly the place with present aviation tracking systems.

Shouldn't the public know who's flying drones over their property? I wish the drone IDs were publicly listed, just like N numbers.

Why does anyone think they deserve a right to privacy for their aircraft in flight? That is a ridiculous invasion of public space.

There is a reason you can’t just plug in anyone’s vehicle license plate and get their name and address.

The information is widely, if not (yet) universally, available.

https://www.eff.org/pages/automated-license-plate-readers-al...

Sounds like we need to fix that with regulation too?

I'd be on board with that.

that's not quite the same thing, as it doesn't provide "name and adress", no?

Considerably more than for those with access.

Again: once an identifier is available, correlating it with other information is trivial.

Thanks for your input. I'm sincerely asking out of ignorance and curiosity around these things.

A fairly classical example of readily de-anonimisable data is location, at postal-code resolution.

With nothing more than two postal codes (ZIP codes in the US), representing home and work, it's possible to individually identify about 90% of the population. That information is available via, say, geocoded location using mobile phone or tracking cookie data.[1]

In the case of device or vehicle tracking such as with drones, it's highly likely that a given device would be used within a particular jurisdiction or activity region. If you can pinpoint specific locations and times within those (e.g., police activity around an address + drone activity, activity following specific infrastructure such as power lines or gas distribution, training locations, etc., etc.) you can probably come up with a strong idea of who operates or owns the equipment.

That is more-or-less the process that was used to identify CIA-operated aircraft used in renditions for "enhanced interrogation" (torture) by amateur plane watchers. See: https://en.wikipedia.org/wiki/Rendition_aircraft https://web.archive.org/web/20130616175922/http://www.common...

________________________________

Notes:

1. The home+work ZIP anecdote is the one I recall. I'm not finding that specifically though this paper mentions four spatio-temporal locations sufficing for 95% of the population: Yves-Alexandre de Montjoye, César A. Hidalgo, Michel Verleysen & Vincent D. Blondel, "Unique in the Crowd: The privacy bounds of human mobility", Scientific Reports volume 3, Article number: 1376 (2013) https://www.nature.com/articles/srep01376

In some European countries you can in fact do exactly that. Useful if you need to ask someone to move their vehicle for example.

I'm sure there's some kind of hypothetical downside, but not one that me or anyone I know have encountered at least.

You also can't drive your car onto my property without permission. There are valid reasons for a drone to do exactly that, and I'd like to know who is looking at my house. It would be nice to Google a drone ID and realize that it's just the power company looking for branches that might take down a power line.

Reply on news.ycombinator.com