Hacking of a Made in India Defence Drone – A Nightmare Waiting to unfold
The evolving Indian defence drone story is moving forward at a blistering pace. News of Defence procurement of drones running into thousands of crores featuring certain very high end applications like Swarm drones , Loitering munitions , High altitude surveillance drones and a host of other applications happens practically on a daily basis.
While all this high decibel drone procurement is great for public consumption seasoned professional in the global drone ecosystem are aware and acknowledge the fact that all this hype has a serious flaw at the very heart of the drones themselves at the flight controller level . The very piece of hardware that makes an aircraft a drone .
Majority of Indian Manufactured drones use
- Open source Flight Control , Communication electronics
- Opensource interface protocols
- Opensource Ground control software
If there is one flaw in opensource technology it is the fact that it is prone to hacking as the code that operates the drone has been developed by hundreds of developers and is openly available for anyone to find vulnerabilities to exploit .
No single person or business entity globally can track down each of these vulnerabilities fix them . This is what makes the use of an open source Autopilot so dangerous .
The very loitering munition or swarm that was used with the hope of attacking the enemy can be turned against the very forces that launched them .
A system level check of majority of Indian manufactured drone systems will reveal either Pixhawk Or Pixhawk Cube based open source Autopilots at the very core motherboard level of the Drones .
Rampant use of such Autopilots based on the Open source “Ardupilot” architecture and firmware (operating system) coupled with open source MAVLINK based protocols is serious matter that needs to be addressed given both the critical national security position viz a viz China and country’s aspirations to be a global drone hub in the near future.
The immediate reaction of Security agencies if and when Hacking / Remote commandeering of an Indian Manufactured drone happens will be to immediately crackdown on the use of Chinese components in the drones electronic systems.
The fact though is that the vulnerability to hacking has nothing to do with the origin of the component at the PCB level unless that particular component has access to transfer & receive data either directly or through the communication systems .
The two systems that are prone to hacking are :
2. Wireless Data Link : Electronic Communication
Significance of both these systems :
- Autopilot : Electronic Flight controller is what replaces “ Man “ in the aircraft making unmanned flight possible , it electronically controls the drone
- Wireless Data Link : Electronic Communication is what makes remote controlling of the Aircraft possible
Understanding Drone Electronics
Mission and locational Critical data on a drone is generated by the on board control and communication electronics namely the Autopilot that is equipped with a range of sensors like IMU , Barometer , Magnetometer , GPS , payload and access to this data happens through the wireless datalink as the communication system.
It is this communication system that manufacturers need to secure by way of either encryption or indigenous manufacturing to ensure against both data leakage , hacking and remote commandeering . Even if an Indian manufacturer has to use a data link imported from China they can modify or create indigenous software/ hardware based encryption layers that will pipeline the data only to specified end points (servers) .
Additionally Proofing against Remote commandeering through location spoofing can be incorporated at the autopilot firmware level for which complete visibility and control of the autopilots firmware is absolutely essential
Genesis of the Problem
Evolution of Indian drones across all stakeholders right from Academia to industry to Defence R&D organisations has largely been to meet end use requirements with little thought applied to security of either the drone or the data it generates and transmits .
Right from the days of the pathetically managed and administered Rs 300 crores government funded NPMICAV project to the multiple current media reports including the highly publicised purchase of Made In India Drones in early 2021 for use across sensitive front line locations in Leh the emphasis has always been on immediate gratification of an end use based need .
The vulnerability and the origin of the easily available , low cost open source Drone autopilot and communication system has never been considered to be important
There has never been a concerted effort nor funds allocated by the defence ecosystem to develop any indigenous capabilities at the core level of Drone Technology it has always been a product to meet a specific end use case .
Even Defence R & D organization like DRDO have been developing drones using opensource electronics. Of recent though a couple of DRDO organizations realizing this flaw and vulnerability have started using the India’s only fully aatmanirbhar Autopilot “NavGati“ developed and manufactured by ZUPPA GeoNavTech on their projects with the aim of resolving this serious shortcoming .
Conclusion
Hence in conclusion considering the above would the Army be justified in being surprised if Indian Manufactured drones and systems for which they paid Crores of Rupees is hacked and remotely commandeered by their adversary from across the border when the fact is that the mission critical control and communication electronics is vulnerable
If and when such an event occurs I believe all the stakeholders in the drone Ecosystem would have to take collective responsibility and address the problem.
