The Signal You Can't Trust: Remote ID And The Drone Security Problem

5Gmb...M2Ub

25 Sept 2026

148

Every day, people across the globe use an assortment of devices and platforms to track the movements of ships, planes and other transportation assets. While this can often be purely for hobby purposes, plenty of systems also rely on accurate tracking information to ensure the world keeps moving.

To help with this, we rely on radio transmissions to ensure that aircraft remain within safe clearances and that the chances of airspace conflicts stay to a minimum.

Like the number plate on your car and ADS-B transmissions used by larger aircraft, drones have their own identification systems as well. Known as Remote ID, it helps us share the airspace during drone operations without increasing the risk to general or commercial aviation.

While this is great in theory, there is one minor problem with this. Both ADS-B and Remote ID rely on open, unauthenticated communication protocols, making them inherently vulnerable to a range of cyberattacks.

Today, we’ll look at the RF stack that helps power the Remote ID system and discuss why it’s an important part of civilian drone operations. Then, we’ll take a look at some of the inherent vulnerabilities and check out what security researchers are currently doing about them.

What Remote ID Actually Does

Remote ID was first sold as a safety measure. With the lightweight drone population expanding and becoming easier to use, it was obvious that something was needed to help keep the airspace safe.

At its core, Remote ID is a broadcast system. A RID-compliant drone transmits a stream of data packets containing its serial number, position, altitude, velocity, and the location of the operator on the ground. It does this continuously while in flight, using one or more of four RF methods defined within the standard: Wi-Fi beacon frames in the 2.4 GHz and 5 GHz bands, Bluetooth 4 legacy advertising, Bluetooth 5 Long Range, and Wi-Fi based, Neighbour Awareness Networking (NAN).

The governing rules vary depending on where you are. In the US, the FAA mandated Remote ID under 14 CFR Part 89. The compliance date was September 2023, with enforcement discretion running until March 2024.

In the EU, product requirements sit in Delegated Regulation 2019/945 and operational rules in Implementing Regulation 2019/947. The EU’s technical standard is ASD-STAN EN 4709-002, not the ASTM F3411 used in the US. The UK CAA has its own equivalent requirements. The specifics differ slightly by jurisdiction. The RF methods are the same.

Anyone with a compatible app, a Bluetooth scanner, or a Wi-Fi monitor can receive those packets. That’s the whole point. Transparency is the design goal.

The catch is that transparency and trust are not the same thing.

The Authentication Problem

The standards that we referenced earlier specify what gets broadcast. They say far less regarding the verification of who is actually broadcasting it. ASTM F3411 does define an Authentication message, but this authentication is optional. The FAA does not require it, and most manufacturers currently don’t implement it. This means that in practice, there’s no signature, handshake, or integrity check.

What this means in the real world is pretty straightforward. The serial number in a Remote ID packet is whatever the sender says it is. The operator location is whatever the sender claims. The position data, the altitude, the velocity readings, every single bit of it is taken on faith by any receiver that picks it up.

It’s worth mentioning that for the most part, the average Remote ID operator is going to have little motivation or incentive to spoof RID transmissions for malicious purposes. However, it’s worth working through this a little more, as many of the attitudes towards Remote ID have some similarities to other security protocols that we’ve looked at in this publication.

We also need to understand that this is no flaw in the Remote ID design. The system is operating as intended. The issues sit further downstream. Most current law enforcement, counter-UAS systems and airspace monitoring tools accept Remote ID transmissions at face value without verification.

What Detectors See

Open any Remote ID app, and you’re going to get a display that looks reasonably similar. There’s going to be a map to plot positions. If there’s a drone that’s active, you’ll see that on the map. You should also see a second pin that will typically identify the position of the pilot or takeoff point. A RID system gives the impression that it is a tracking system that knows what it is talking about.

However, it’s important to understand what’s happening behind the scenes, because the interface and the data behind it are two very different things.

Remote ID doesn’t send one giant chunk of information. It defines a set of distinct message types, each carrying specific fields.

The Basic ID message carries the serial number, the UA type, and the ID classification.

The Location message carries position, altitude, speed, and heading.

The Authentication message carries optional signature data.

The System message carries the operator’s ground position and classification data.

The Operator ID message carries a CAA-assigned identifier. This is mandatory in the EU but not currently used in the US.

Receivers pool all of these together, then present them as a unified, coherent picture. And, in almost every case, at no point in the identification pipeline is any form of verification carried out.

A receiver displaying a legitimate registered drone and a receiver displaying a spoofed or fabricated one look similar. The interface doesn’t know the difference, because the protocol doesn’t give it the tools to find out.

It’s also worth stopping for a second and considering the position of the operator too. Many people aren’t currently aware that their own location is often included as part of the Remote ID broadcast.

Every receiver in range picks it up. Official monitoring systems, counter-drone platforms, app users, and anyone running a passive Bluetooth scanner. There is no record of who received it or when. That data goes out, and it doesn’t come back.

Detection range varies by signal type, antennas used, and quality of the installation. Typically, a well-installed system with good, external antennas can have range measured in kilometres.

Bluetooth 5 Long Range coded PHY extends that considerably. An upgraded antenna, with the addition of a preamplifier or filter, will give the best results in most circumstances. Remote ID is by no means a short-range system.

Identifying Malicious Packets

There is no reliable method for identifying a malicious Remote ID packet at the protocol level. Everything in this section is heuristic detection. Pattern recognition. Educated guesswork. Or clearly misconfigured packets that do not correlate with what the receiver is seeing. The easiest way to consider this is in a layered approach.

Layer 1: What The Packet Says

These are checks on a single message. Here we are looking for inconsistent data. This could be a UA type that doesn't fit speed/altitude metrics, mismatched or missing message types or timestamps that drift or run backwards.

Layer 2: Time-Based Behaviours

One packet gives us a brief snapshot, multiple give us a usable data stream that can catch patterns that a single packet won’t show. This could be broad position changes over time, acceleration or speed patterns outside performance metrics, or the same serial appearing in multiple places at once.

Layer 3: The RF Layer

This is often the strongest layer. While you can successfully fake single packets or even create an entirely false data stream, it’s much harder to fake the physics that help dictate how RF behaves. Inconsistencies between received signal strength and claimed distance, and using Time Difference of Arrival (TDOA) techniques to confirm claimed positions can reveal suspect or malicious packets.

It’s worth mentioning that these are just a few of the methods that can be used for identifying bad data. While the first two layers tend to catch lazy or broken spoofing techniques, careful management of the track can help an attacker evade this. This leaves us with the RF layer being one of the most interesting methods and often, the only layer left for analysis purposes.

Big Picture Problems

Remote ID has plenty of potential for helping to integrate shared airspace operations in a safe manner. At its core though, this is a collective effort. Remote ID systems will help to identify both compliant and careless operators. What it won’t do is stop people determined to operate UAV’s without such systems fitted. The real-world consequence of this means the absence of a RID signal is often more significant than the spoofing of one.

However, despite this, spoofing is still something that deserves consideration. The risk of decoy tracks helping to overload counter-UAS operations is real, and spoofed packets can be shaped with incorrect serial numbers, making it harder to determine the actual aircraft or operator.

If you’ve read this publication for a while, you might have connected with the fact that this same trust model underpins other systems as well. GNSS, AIS and ADS-B are also vulnerable to the same failure mode. The more things change, the more they stay the same.

However, many problems can be improved with the implementation of existing solutions, and in this instance, Remote ID is no different. Mandating the authentication message that already exists in the standard and building detection systems that verify it would help to mitigate issues around spoofing.

Treating Remote ID detection systems as a sensor within a system rather than the actual truth would help increase the integrity of the air traffic management system at large.

The good news is that the IETF’s DRIP working group has already built a framework for trustworthy Remote ID, so the groundwork exists already.

The TL/DR of Remote ID? It tells us what and who the drone claims to be.
Determining if the information is true or not is your job.

Investigator515 explores the RF spectrum, cybersecurity, and the hidden tech behind modern espionage.

Follow for new content weekly
Bluesky • X • Substack

You might also like,