An Air Force F-22 Raptor flies over Syria on Dec. 1, 2017. (Paul Labbe/U.S. Air Force photo)

The Defense Department and Federal Aviation Administration have yet to resolve security risks to military aircraft posed by a new tracking system required to be implemented in less than two years, according to a government audit released Thursday.

Although those agencies and other organizations have identified the system’s risks to military security and missions over the past decade, approved solutions remain an “urgent need,” the Government Accountability Office said in the public version of a classified report.

All aircraft flying in domestic airspace must have the technology installed by Jan. 1, 2020.

Up to now, DOD and FAA have focused on how to equip military aircraft with the Automatic Dependent Surveillance-Broadcast Out technology, with much less thought given to solving or mitigating security risks, the GAO said.

In 2010, the FAA issued a final rule requiring all civilian and military aircraft flying within U.S. airspace to be equipped with ADS-B Out, which uses satellites to transmit flight information to enabled receivers. ADS-B Out is a key component of the FAA’s ongoing modernization effort to switch from a ground-based radar system to a satellite system for aircraft position reporting, navigation and digital communications.

ADS-B Out employs an aircraft’s avionics systems to broadcast position, altitude, velocity and other data to receivers on the ground, air or space, the GAO said.

It is part of the FAA’s so-called NextGen system intended to increase safety, reduce delays, decrease costs for airlines and passengers and cut down carbon emissions.

However, the NextGen system’s reliance on internet protocols, digital communication and GPS creates a greater risk of it failing or being hacked, the GAO said.

As far back as 2008 the DOD had notified the FAA that military aircraft would need “special accommodations” due to national security concerns, in areas such as sensitive missions and electronic-warfare vulnerabilities, the GAO said.

In 2010, the FAA notified the DOD, Department of Homeland Security and other agencies that it would collaborate with each of them to produce agreements to accommodate national defense requirements.

Since that time, the DOD has identified steps that could be taken to mitigate risks, such as “masking DOD aircraft identifiers, maintaining current inventory of primary-surveillance radars, allowing pilots to turn off ADS-B broadcasts, and seeking an exemption from installing ADS-B technology on select military aircraft (for example, fighter and bomber aircraft),” the GAO said.

But as of June last year, the DOD and FAA have not approved any solutions to risks, the GAO said.

The risks to military aircraft arise from information broadcast by the ADS-B being illicitly intercepted or the system’s vulnerabilities being exploited by cyberattack.

The GAO cites a 2015 assessment by the Rand Corporation that found “broadcasting of detailed and unencrypted position data for fighter aircraft, in particular for a stealth aircraft such as the F-22, may present an operations security risk.”

The Rand report noted that information about the F-22’s exact position is classified Secret, and thus its unauthorized disclosure could cause “serious damage to national security.”

The DOD has informed the FAA that ADS-B Out technology could allow third parties to identify military aircraft flying “sensitive missions,” such as “low-observable surveillance, combat air patrol, counter-drug, counter-terrorism, and key personnel transport,” the GAO said.

Some military aircraft are equipped with an earlier generation of transponders that could potentially allow a third party to track altitude. ADS-B Out, however, will provide much more detail, such as an aircraft’s precise location, velocity and airframe dimension, the GAO said.

“ADS-B technology better enables individuals and groups to track flights in real time and use computer programs to log ADS-B transmissions over time,” the GAO said. “Therefore, individuals or groups could observe flight paths in detail, identify patterns-of-life, or counter or exploit DOD operations.”

The GAO cites a 2015 article by the Institute of Electrical and Electronics Engineers concluding that adversaries could hack in and insert bogus ADS-B messages that create “ghost” aircraft on the ground or air; delete ADS-B messages, which could make a plane disappear from the screen of an air-traffic controller; and modify messages, for example changing the reported path of a aircraft. The article said that jamming attacks against the system would be “simple” and that ADS-B data has no verification measures to filter out fake messages.

The FAA is aware of such possible attacks, and both it and DOD have identified a potential solution to this vulnerability, the GAO said.

But as of November, the solution had not been tested, nor had testing been scheduled, the GAO said.

The DOD does not have a “coordinated or accurate” schedule for equipping military aircraft with the new technology, the GAO said.

The DOD and FAA expect to complete a memorandum of agreement in February to both set that schedule and to address security concerns, the GAO said.

olson.wyatt@stripes.com Twitter: @WyattWOlson