DEF CON 33 - Voice Cloning Air Traffic Control: Vulnerabilities at Runway Crossings - Andrew Logan
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 22:40
Revised Summary
Andrew Logan, an audio engineer, warns at Defcon that AI voice cloning technology poses a serious threat to aviation safety by enabling attackers to impersonate air traffic controllers and issue false clearances, particularly during adverse weather conditions when visibility is poor. 1:43
Key Takeaways:
• Voice cloning technology requires only 10 seconds of controller audio to create convincing false clearances, exploiting AM radio's unencrypted, analog nature and weak capture effect. 1:58-2:00 3:00-4:29
• High-power transceivers (25-45 watts) are readily available on the market for under $200, with domestic manufacturers not required to verify buyers, creating a significant security vulnerability. 4:29-5:29
• Runway crossings are at highest risk during poor visibility conditions, as demonstrated by historical incidents like the 1977 Tenerife disaster (583 fatalities) and the 2024 Haneda collision, where multiple safety systems failed simultaneously. 13:36-16:58
• Current safeguards like stop bars (installed at only 26 US airports) and TAWS (inactive below 1,000 ft) prove insufficient under operational stress or when out of service, illustrating the Swiss cheese model of safety failures. 16:13-16:58
• Logan demonstrates live how easily a cloned controller voice can instruct a plane to cross a runway, highlighting the need for enhanced flight vision systems and AI platform guardrails to verify ATC instructions. 18:00-19:29
Logan urgently calls on pilots, controllers, and regulators to recognize this emerging threat and implement technological and policy reforms before
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Please help me welcome Andrew Logan doing talks on uh voice cloning air traffic control. Thank you. Very excited to be at my uh 33rd Defcon. Now, this is my fourth Defcon. Uh and I want to start by saying my name is Andrew Logan. I am not a pilot, an air traffic controller, or really even an aviation professional. But now that we're letting comedians make recommendations about how to fix a line safety, I figure I'll give it a shot. I am an audio engineer like Rob in the back. Give it give it up for Rob. Um, and I was up here two years ago talking about tracking the military ghost helicopters of DC. Um, that project relied heavily on Twitter. Let's take a moment of silence to remember Twitter. Uh, now we're at coperspotter.com, but in that talk I was critical of the military's use of ADSB e…