Protecting Your Passengers, Crew in This Flight-Tracking Age with the Privacy ICAO Address Program

Oct. 23, 2024

At the 2024 NBAA Business Aviation Convention & Exhibition (NBAA-BACE), top security experts, led by moderator Kristie Greco Johnson, NBAA senior vice president of government affairs, shared how to keep crew members and passengers safe and secure from competitive espionage and other threats, at a time when flight tracking is more easily accessible.

Daniel Baker, founder of FlightAware, described the recent history of aircraft data security, explaining how the implementation of ADS-B fundamentally changed data security in the industry. Now, data is not just available from FAA but is available from aircraft directly and can be picked up by a receiver on the ground, he told a full audience during a session at the Flight Deck.

“We’ve faced data security challenges before. We looked at the industry perspective and solved them,” said Baker, adding industry and government must keep up with changing technology and evolving risks.

One such solution to these challenges is the Privacy ICAO Address (PIA) program, which allows aircraft owners to request a temporary, alternate ICAO address for their aircraft. That anonymized ICAO code, used in ADS-B Out transmissions, is not connected to aircraft owner information in a public-facing way. The PIA program is applicable to U.S.-registered aircraft, and while mostly effective in domestic airspace, has recently been expanded to include some oceanic and Gulf of Mexico routes.

Steve Saflin, vice president aviation and travel services at Walmart, shared his perspective on aircraft data security as a flight department leader. In his view, protecting the privacy of passengers is a shared responsibility of the operator, service providers and government agencies. Ensuring owner and route privacy can be essential to avoiding insider trading activities.

Saflin explained a recent change from the 2024 FAA Reauthorization Bill, which exempts Limited Aircraft Data Displayed (LADD) list data and aircraft in the PIA program from disclosure through the Freedom of Information Act (FOIA), seeks to keep up with the sophistication of bad actors.

He urged attendees to share with NBAA any concerns regarding registering for or complying with the PIA, including the physical act of changing the ICAO address, which is considered a maintenance event for some aircraft and avionics suites.

Jim Cooling, managing partner at Cooling and Herbert, described how his firm provides legal advice to clients on participating in the PIA program and its predecessors before that, primarily to mitigate the risk of corporate espionage. He also encouraged the industry to work with international organizations to identify a global solution.

Jean Rosanvallon, former president and CEO at Dassault Falcon Jet, shared how privacy is integral to personal safety for some high-profile passengers and encouraged attendees to be part of the solution by sharing their experiences.

“If people give up on their security, they will not buy a new airplane and will go through other avenues,” said Rosanvallon. “We are very motivated to help our customers, and for our own business that we do not suffer from our lack of actions.”

Co-founder of ForeFlight Tyson Weihs believes it will require the community to put together the building blocks to a solution but is optimistic that industry and government together can tackle the challenge.

“One of the most transformative things to the business [of ForeFlight] was ADS-B. As a technologist, you always have sense of urgency and interest in solving problems, making the complex very simple,” he said. “The FAA is leaning into this and is progressively making it simpler.”

All panelists, including moderator Greco-Johnson, concurred with the FAA’s collaboration with the industry in identifying creative methods to secure aircraft data.

In addition to the exemption from FOIA disclosure as legislated by the 2024 FAA Reauthorization Act, two other changes are now effective in the PIA program.

First, to receive CPDLC services while using PIA, the pilot or designated flight plan filing service must file the PIA ICAO 24-bit address and N-number in the ICAO flight plan. Second, aircraft operators may request a new PIA assignment any time following a 20-day period from a previous PIA assignment.

Visit the FAA’s ADS-B Privacy web page for the latest information and contact adsbprivacyicao@faa.gov with questions.

View NBAA’s privacy resources.