Air Flight from Terrorism

In the post-9/11 security paradigm, the aviation industry and its regulatory overseers have constructed a formidable physical fortress. The TSA’s layered security—backscatter X-rays, explosive trace detection (ETD), and behavioral analysis—has rendered the traditional "shoe bomber" or "underwear bomber" a statistical anomaly. The physical supply chain is secured. The passenger is screened. The aircraft doors are armored.

The Russo-Ukrainian war has provided a live-fire laboratory for EW, demonstrating that the electromagnetic spectrum is a contested domain as critical as land or air. Russian forces have deployed high-power, broad-spectrum jammers operating in the 2.4 GHz to 5.2 GHz ranges, effectively creating a denial-of-service (DoS) attack on the RF environment.

These systems do not merely target specific GPS L1/L2 frequencies. They operate as "dumb fire" barrage jammers, saturating the spectrum with noise. This brute-force approach is so pervasive that it causes self-inflicted degradation, jamming their own communications and even the GPS guidance of their own glide bombs. The takeaway for a security analyst is chilling: if you can jam your own military’s communications accidentally while attempting to block a drone, you are broadcasting an incredibly high noise floor. An airport is a static, known location. It is a target that cannot relocate. The same technology that saturates the Donbas is easily repurposed for a domestic aviation attack.

Importantly, the Ukrainian response to this jamming highlights the evolving nature of navigation. To bypass EW, they have reverted to analog and optical solutions: AI-powered terminal guidance, optical recognition of terrain, and the curious re-emergence of fiber-optic cable tethers. A drone tethered by fiber optics is immune to RF jamming, but a Boeing 777 cannot deploy a 5-kilometer fiber optic cable to land. It is an RF slave, and its master signal is susceptible.

Visual Flight Rules (VFR) are irrelevant to the modern commercial airline when the weather turns. In conditions of low visibility, fog, heavy rain, or snow, aircraft transition to Instrument Flight Rules (IFR). The cornerstone of IFR is the Instrument Landing System (ILS).

The ILS is an RF-based precision approach and landing aid. It relies on two primary ground-based arrays:

These are analog, amplitude-modulated signals. They are incredibly precise, but they are incredibly simple. The aircraft’s Flight Management Computer (FMC) relies on these analog beams to command the autopilot during a Category III (Cat III) approach, where the aircraft virtually lands itself. There is no cryptographic handshake, no hopping frequency, and no authentication between the ground station and the aircraft. The plane is essentially a receiver listening for a faint, unencrypted beacon. When that beacon is degraded, the autopilot cannot "see" the runway.

The technical barrier to entry for this attack is remarkably low. It does not require state-sponsored infrastructure. It requires a technically competent individual—someone akin to a "computer hacker" of the RF world—who can source a wideband RF amplifier and a directional Yagi or log-periodic antenna.

A threat actor would not need to sustain jamming for a long duration; that would risk triangulation by FCC direction-finding gear. Instead, they require a "Blast" attack lasting 15 to 30 seconds. This window aligns with the "Kill Zone" of a landing approach—the final moments when the aircraft is descending below the minimum decision altitude (DA).

The Attack Vector:

The Result: The localizer indicator on the PFD (Primary Flight Display) drifts. The glide slope pointer "fails." The autothrottles may receive erroneous data. In heavy fog, where VFR is impossible, the pilot suffers spatial disorientation and a loss of SA (Situational Awareness). The phrase "Minimums, Minimums" is heard, and the aircraft is off-center. The "Hack" is complete.

The FAA is a regulatory authority focused on safety, the FCC focuses on interference; neither agency is prepared for an adversarial, offensive jamming attack at a fixed point. There is a general ignorance regarding the offensive capabilities available on the open market. I have observed, first-hand, that the agencies view jamming through the lens of "amateur radio interference" rather than "targeted kinetic warfare." They are, unfortunately, ignorant of the creative lethality inherent in modern RF engineering from a computer hacker.

We rely on the assumption that "someone" will monitor the spectrum for anomalies. We rely on the assumption that "it won't happen here." History has proven both assumptions false.

The threat to aviation is no longer a physical component hidden in a shoe. The threat is the digitized, RF-dependent nature of the aircraft itself. We are flying computers through a contested spectrum. The infrastructure at our airports—the localizers, the glideslopes, the GPS augmentation—is an unsecured network. To secure the skies, we must harden the spectrum. This requires cryptographic authentication of navigation signals (e.g., like the proposed GPS authentication) and advanced receivers capable of filtering brute-force broadband noise.

Until then, we remain vulnerable. It is not a question of if the RF environment will be weaponized, but when. We owe it to the memory of those we lost on 9/11, and to every passenger flying through the fog, to wake up to this reality. I have already performed numerous thought experiments on the capabilities of a terror attack on JFK And LaGuardia AirPort, I live in Queens, New York and am a semi-retired uber computer hacker...

God bless everyone.

Paul F. Renda has spent over 40 years in information security. He has spoken at a number of above-ground and below-ground hacker conferences. He studied physics and math at Queens College and the University of Houston, and he has worked as a system administrator for IBM Z/OS and Linux systems. He was also recruited (recruited is a nice, friendly way to put it) by the FBI/NYPD Joint Terrorism Task Force to provide open-source high-impact information. The Russian Federation and the Department of Defense also wanted to become Paul’s friend. He declined the friendship overture from the Russian Federation. Paul uses his hacker ability to look at social issues from a different perspective.

image: A U.S. Air Force F-35A Lightning II aircraft from the 493rd Fighter Squadron lands on the runway past an Air Traffic Navigation, Integration and Coordination System during Ramstein Flag 26 at Pirkkala Air Base, Finland, June 9, 2026. The integration of the mobile Marine Corps radar system with fifth-generation Air Force assets validates joint Agile Combat Employment capabilities and strengthens regional air defense networks. (U.S. Air Force photo by Tech. Sgt. Christine Groening)