No missile required
Shooting down an aircraft takes a weapon. Making a commander believe an aircraft is somewhere it is not takes a transmitter and a laptop. ADS-B, the broadcast most of the world's air picture is built on, has no authentication. Researchers showed years ago that anyone with inexpensive radio hardware can inject aircraft that do not exist or alter the reported position of ones that do. Satellite positioning, which ADS-B depends on, is jammed and spoofed daily across three theaters.
Any tracker that fuses these sources inherits their weaknesses. The question is what it does with a report it should not believe.
Five ways to attack a tracker
We built EdgeLance's multi-domain tracker against five attacks. Hijack: inject reports that drag an established track somewhere else. Backdate: send reports stamped in the past to rewrite what the picture showed. Downgrade: claim a lower trust level or classification to slip past a check. Contest: have a second source claim an identity that already belongs to a track. Exhaust: flood the tracker with conflicts until it either locks out legitimate sources or runs out of room.
Each of these is cheap for an attacker and expensive for a defender who discovers it after the fact.
How the tracker answers
The tracker validates every observation against the mission's schema before it touches a track, and it fails closed. Untrusted, foreign, and downgrading inputs are rejected outright. Reports with timestamps behind what the tracker has already accepted are refused, so history cannot be rewritten. An established track cannot be moved by a source that lacks the standing to move it.
When two sources contest an identity, the tracker does not pick a winner silently. It splits the contested reports into a separate track, marks it disputed, and shows both to the operator. Splits are budgeted, and weak ones are evicted first, so an attacker cannot exhaust the tracker and cannot lock out a legitimate source by flooding it. Nothing an attacker can forge affects how tracks are ranked. The logs record what happened without recording the identities involved.
The tracker sits between the sensor fabric and asset tasking, which is why its refusals matter. A spoofed track that survives fusion becomes a target that gets offered to a real asset.
Least privilege around the tracker
The tracker is one block in a chain, and every block in EdgeLance runs with its own credentials and may publish only to the topics it needs. Vehicle positions are accepted only from the vehicle bridge's own account. A compromised camera feed can produce bad detections, and the tracker will treat them as claims from a camera. It cannot publish a vehicle position, issue a task, or dispatch an order.
Defense in depth here is unglamorous. It is a long list of things each component is not allowed to do, enforced by the broker and checked by the consumer.
We set out to design for distrust from the start. The security page lists the controls in one place, and the Execution Gap whitepaper shows where the tracker fits in the chain from sensor to shooter.
A picture you can defend
An air picture that accepts every report is an air picture the adversary can draw on. The standard for contested environments should be a tracker that refuses what it cannot verify, keeps disputes visible, and records every decision for review. The operator gets a smaller picture they can trust in place of a larger one they cannot.