The role of no radio (NORDO) events in airspace security

The FAA and the other air domain security partners are employing multilayered security techniques to attempt to deter and prevent attacks such as a hijack from happening in the future. However, there exists the possibility that the security measures employed can be circumvented or defeated, and that terrorists can take unauthorized control of an aircraft while in flight. If such a situation occurs, it is critical to detect the situation and to do so as soon as possible. Time is critical in these situations - the earlier the attack is detected, the more time is available to mitigate the situation. Sometimes there is an event that might be an indicator that an attack is underway. One such event is the loss of two-way radio communication with a flight under air traffic control. Monitoring for such events helps gain critical time needed for response if a hijack is occurring. However, loss of radio communication is a relatively common event - several occur each day in the National Airspace System. The vast majority of these events are not an indication of a possible hijack - they occur for other reasons. So the challenge becomes: how to differentiate between the vast majority of loss of communication events due to reasons other than an attempt to take unauthorized control of an aircraft while in flight from those that are (this is a classic "needle in the haystack" problem). This paper discusses a preliminary analysis of loss of radio communication events. MITRE's Center for Advanced Aviation System Analysis (CAASD) conducted this analysis to gain insight into these events which might lead to improvements in their use as an indicator of a potential security incident such as a hijack.