Air flight from terrorism

The ILS Vulnerability and the Imminent Threat of Spectrum Warfare

In the post-9/11 security paradigm, the aviation industry and its regulatory overseers have constructed a formidable physical fortress. The TSA’s layered security—backscatter X-rays, explosive trace detection (ETD), and behavioral analysis—has rendered the traditional “shoe bomber” or “underwear bomber” a statistical anomaly. The physical supply chain is secured. The passenger is screened. The aircraft doors are armored.

This is a false sense of security. It is a cognitive bias that focuses on the physical while ignoring the ethereal. The true existential threat to modern air travel is not in the luggage hold; it is in the electromagnetic spectrum. As a survivor of the 1993 World Trade Center bombing and a relative of a first responder lost on 9/11, I understand the cost of ignorance intimately. The next attack will not require a box cutter or a pound of PETN. It will require a 100-watt amplifier, a software-defined radio (SDR), and 15 seconds of broadcast time.

To understand this vector, we must analyze the operational dependencies of modern avionics and cross-reference them with the kinetic and electronic warfare (EW) tactics observed in the Ukrainian theater. I have previously detailed aspects of this threat in an article for the Military Cyber Professionals Association (MCPA) titled “The Poor Man’s EMP Nuke,” a paper which notably reached White House review. The principle is simple: the integrity of flight depends entirely on the integrity of the radio frequency (RF) environment, and that environment is fragile.

The Ukrainian EW Proving Ground

The Russo-Ukrainian war has provided a live-fire laboratory for EW, demonstrating that the electromagnetic spectrum is a contested domain as critical as land or air. Russian forces have deployed high-power, broad-spectrum jammers operating in the 2.4 GHz to 5.2 GHz ranges, effectively creating a denial-of-service (DoS) attack on the RF environment.

These systems do not merely target specific GPS L1/L2 frequencies. They operate as “dumb fire” barrage jammers, saturating the spectrum with noise. This brute-force approach is so pervasive that it causes self-inflicted degradation, jamming their own communications and even the GPS guidance of their own glide bombs. The takeaway for a security analyst is chilling: if you can jam your own military’s communications accidentally while attempting to block a drone, you are broadcasting an incredibly high noise floor. An airport is a static, known location. It is a target that cannot relocate. The same technology that saturates the Donbas is easily repurposed for a domestic aviation attack.

Importantly, the Ukrainian response to this jamming highlights the evolving nature of navigation. To bypass EW, they have reverted to analog and optical solutions: AI-powered terminal guidance, optical recognition of terrain, and the curious re-emergence of fiber-optic cable tethers. A drone tethered by fiber optics is immune to RF jamming, but a Boeing 777 cannot deploy a 5-kilometer fiber optic cable to land. It is an RF slave, and its master signal is susceptible.

The Achilles Heel: ILS and VOR/DME

Visual Flight Rules (VFR) are irrelevant to the modern commercial airline when the weather turns. In conditions of low visibility, fog, heavy rain, or snow, aircraft transition to Instrument Flight Rules (IFR). The cornerstone of IFR is the Instrument Landing System (ILS).

The ILS is an RF-based precision approach and landing aid. It relies on two primary ground-based arrays:

1. The Localizer: Operating in the VHF band (108.1 – 111.95 MHz), it provides lateral guidance, ensuring the aircraft is aligned with the runway centerline.
2. The Glideslope: Operating in the UHF band (329.15 – 335.0 MHz), it provides vertical guidance, ensuring the aircraft descends at the correct angle (typically 3 degrees).

These are analog, amplitude-modulated signals. They are incredibly precise, but they are incredibly simple. The aircraft’s Flight Management Computer (FMC) relies on these analog beams to command the autopilot during a Category III (Cat III) approach, where the aircraft virtually lands itself. There is no cryptographic handshake, no hopping frequency, and no authentication between the ground station and the aircraft. The plane is essentially a receiver listening for a faint, unencrypted beacon. When that beacon is degraded, the autopilot cannot “see” the runway.

The Hacker’s Exploit: Jamming the “Kill Zone”

The technical barrier to entry for this attack is remarkably low. It does not require state-sponsored infrastructure. It requires a technically competent individual—someone akin to a “computer hacker” of the RF world—who can source a wideband RF amplifier and a directional Yagi or log-periodic antenna.

A threat actor would not need to sustain jamming for a long duration; that would risk triangulation by FCC direction-finding gear. Instead, they require a “Blast” attack lasting 15 to 30 seconds. This window aligns with the “Kill Zone” of a landing approach—the final moments when the aircraft is descending below the minimum decision altitude (DA).

The Attack Vector:

1. Hardware: A high-power amplifier (approx. 100-200 watts) capable of broadband noise generation, tuned to cover the 108-112 MHz and 328-335 MHz bands simultaneously.
2. Location: A vehicle parked near the airport perimeter, specifically within line-of-sight of the approach path. Airports like JFK are geographically surrounded by major roadways and public areas (e.g., Idlewild Park, Rockaway Boulevard).
3. Execution: The attacker monitors the approach frequency (e.g., JFK Tower 119.1 MHz) and hears the final handoff. They wait for the “Cleared to land” confirmation.
4. The Moment: As the pilot disengages the autopilot or engages the approach mode, the attacker keys the transmitter. The noise floor spikes.

The Result: The localizer indicator on the PFD (Primary Flight Display) drifts. The glide slope pointer “fails.” The autothrottles may receive erroneous data. In heavy fog, where VFR is impossible, the pilot suffers spatial disorientation and a loss of SA (Situational Awareness). The phrase “Minimums, Minimums” is heard, and the aircraft is off-center. The “Hack” is complete.

The Regulatory Vacuum

The FAA is a regulatory authority focused on safety, the FCC focuses on interference; neither agency is prepared for an adversarial, offensive jamming attack at a fixed point. There is a general ignorance regarding the offensive capabilities available on the open market. I have observed, first-hand, that the agencies view jamming through the lens of “amateur radio interference” rather than “targeted kinetic warfare.” They are, unfortunately, ignorant of the creative lethality inherent in modern RF engineering from a computer hacker.

We rely on the assumption that “someone” will monitor the spectrum for anomalies. We rely on the assumption that “it won’t happen here.” History has proven both assumptions false.

Conclusion

The threat to aviation is no longer a physical component hidden in a shoe. The threat is the digitized, RF-dependent nature of the aircraft itself. We are flying computers through a contested spectrum. The infrastructure at our airports—the localizers, the glideslopes, the GPS augmentation—is an unsecured network. To secure the skies, we must harden the spectrum. This requires cryptographic authentication of navigation signals (e.g., like the proposed GPS authentication) and advanced receivers capable of filtering brute-force broadband noise.

Until then, we remain vulnerable. It is not a question of if the RF environment will be weaponized, but when. We owe it to the memory of those we lost on 9/11, and to every passenger flying through the fog, to wake up to this reality. I have already performed numerous thought experiments on the capabilities of a terror attack on JFK And LaGuardia AirPort, I live in Queens, New York and am a semi-retired uber computer hacker…

God bless everyone.

---

Paul F. Renda has spent over 40 years in information security. He has spoken at a number of above-ground and below-ground hacker conferences. He studied physics and math at Queens College and the University of Houston, and he has worked as a system administrator for IBM Z/OS and Linux systems. He was also recruited (recruited is a nice, friendly way to put it) by the FBI/NYPD Joint Terrorism Task Force to provide open-source high-impact information. The Russian Federation and the Department of Defense also wanted to become Paul’s friend. He declined the friendship overture from the Russian Federation. Paul uses his hacker ability to look at social issues from a different perspective.

image: A U.S. Air Force F-35A Lightning II aircraft from the 493rd Fighter Squadron lands on the runway past an Air Traffic Navigation, Integration and Coordination System during Ramstein Flag 26 at Pirkkala Air Base, Finland, June 9, 2026. The integration of the mobile Marine Corps radar system with fifth-generation Air Force assets validates joint Agile Combat Employment capabilities and strengthens regional air defense networks. (U.S. Air Force photo by Tech. Sgt. Christine Groening)