How the Massachusetts State Police Can Monitor Drones

A month ago I made a public records request to the Massachusetts State Police (MSP) via Muckrock about their use of drone monitoring software during the George Floyd protests in Boston.

The response I got back was basically "yes we do have it, no you can't see the manual because it's still being written". Or in legal speak:

In light of the fact that the manual is not completed, the withholding of these records is necessary in order for the Department to perform its proper governmental function of producing a working manual for the effective detection of drones.

However I did find out that RFPs and contracts from all "Commonwealth of Massachusetts' Executive Departments." can be found online through COMMBUYS and what I was looking is under the contract ANTI-DRONE TECHNOLOGY; DJI AEROSCOPE ANTENNAS.

Plugging DJI Aeroscope into Google brings up a wealth of information. There are a ton of resources available including an article on The Verge but DJI's own website has the most succient description.

AeroScope is a comprehensive drone detection platform that rapidly identifies UAV communication links, gathering information such as flight status, paths, and other information in real-time. This monitoring data stream helps users make an informed response as soon as possible.

The system can be used with either stationary or portable units and depending on the antenna configuration has a range of up to ~30 miles with the stationary units or ~3 miles with the portable unit. This is combined with a software package that "provides central monitoring, command, and investigation tools".

Granted it can only monitor DJI drones but they account for the lions share of the drone market so it's not surprising the MSP would buy this system.

Data from COMMBUYS

Thankfully the COMMBUYS website has a search function so I was able to find both the bid and the purchase order/contract for the Aeroscope system the MSP bought. If anybody wants to follow along the bid number is BD-20-1084-POLGH-GHQ-47945 and the PO/contract number is PO-20-1084-POLGH-GHQ-18977.

I went through the documents and found a few interesting pieces of information. The name of the company that won the bid (Gresco Utility Supply, Inc), the Request For Response document (RFR DRONE ID_1.30.20.doc) and the quote from Gresco (MSP_QUOTE_COMMBUYS~1.pdf). Any information in this section is going to be from these documents or publicly available resources.

First up is RFR DRONE ID_1.30.20.doc which is 22 pages long and only has about a page and a half of relevent information.

1.1 Procurement Scope and Description

The Commonwealth of Massachusetts Department of State Police is soliciting Bidders for the acquisition of up to EIGHT (8) DJI Aeroscope G-8 antennas with related support, service and specific server requirements. Bids must be received in accordance with the requirements by January 30, 2020 by 2PM EST.

This gives me the antenna model number: G-8. The DJI website has an info sheet on these antennas but it doesn't give a ton of information. Thankfully the Gresco page on Aeroscope has a pretty good description.

The G-8 system offers the widest variety of deployment options. The G-8 incorporates a four-panel array of high gain directional antennas to increase the effective range of the system for greater detection capability. The system includes a weather resistant radio system that can endure harsh conditions. The system is equally applicable for both permanent installations and temporary ones. It can be installed on buildings, towers, or mounted on mobile command posts.

Based on the Gresco and DJI websites each antenna is directional and has a maximum range of 15 miles. With four of them together on a pole you have 360 degree coverage. Gresco also appears to offer two mobile options for the G-8: the Mobile Tower and the Tactical Kit.

1.2 Background information

Funding for the procurement of this equipment is being provided by the 2019 Homeland Security Grant Program.  Federal Funds are to be utilized for this procurement.  Respondents will not be considered if they appear on the Federal Government’s Debarment list.

tl;dr: we got a bunch of money from DHS and by golly we're going to use it! How much money? At least this much:

The estimated value of purchase(s) resulting from this Bid is $235,165 for this DJI Aeroscope purchase. The Commonwealth makes no guarantee that any commodities or services will be purchased from any Contract resulting from this Bid.

The majority of the information is in Section 3: Specifications which is on page 6 of the document.

A couple of things can be inferred from this:

• There is apparently an existing Aeroscope system in New England and it may be a meshed network.
• The MSP wants the deployment model to be centralized with clients accessing a server.
• They don't want any data getting back to DJI.
• Eight hours is an hell of an SLA.

The rest of the document is pretty boring unless you really want to know about the terms and conditions for sending bids to MA agencies.

But what did the MSP actually buy? For that I looked at the Gresco quote (MSP_QUOTE_COMMBUYS~1.pdf). Note that this is just the quote, the actual purchase order doesn't explicity list out the items, just links to the quote in the COMMBUYS system.

Time to translate some vendor speak.

• Radio Units likely refers to the "Stationary Unit" that the DJI website mentions. That model number is AS-F1800.
• The MSP did not appear to buy the mobile solutions that Gresco offers.
• The server is sitting in AWS and the G-8s are connected "securely" to them.

Between the RFR and the Gresco quote I know that the MSP bought a drone monitoring system. What's still a little murky is the coverage the system provides. Since the MSP requested pricing per G-8 antenna I'm going to make the assumption they bought eight separate antennas.

Update 06/09/21: I got clarification from the MSP via a new public records request. They bought eight G-8 systems which have four antennas each. See https://www.muckrock.com/foi/massachusetts-1/clarification-on-purchase-of-dji-aeroscope-g-8-antennas-111461/

Each antenna has ~90 degree coverage up to 15 miles. From looking at the documentation they're meant to be in a four antenna configuration which gives 360 degree coverage. If they use that configuration they've got the ability to cover two 15 mile radii.

Alternatively I suppose they could scatter them across the state and overlap them somehow to give them a larger coverage area but I'd need to start drawing 90 degree angles on a map to figure that out.  

Now that I knew the hardware it was time to figure out what the software actually does outside of being a "drone detection platform". Turns out it does more than shows you where a drone is on the map. DJI has a user guide for the software they host but since Gresco is the vendor (and hosting the server) I'm going off what they have on their website.

So while they can't get control of the drone they can certainly get a lot of information on one extremely quickly. This coupled with the fact that the MSP has multiple helicopters equipped with video downlink capability means that (in perfect conditions) if they wanted to find the pilot of a drone on the ground they probably could.

With that being said one of the reviews I found by a vendor does mention it's not a perfect system. It has trouble identifying older drone models, is subject to RF interference and MAC addresses can be modified or spoofed. However it's still an extremely powerful system.

Based on the dates in the COMMBUYS portal it also appears to be a recently deployed system in MA. The PO was entered into the sytem on 3/11/20, sent to Gresco on 05/01/20 and has a change order as recent as 06/03/20.

Which leads nicely into the next section.

Unknowns and Next Steps

The biggest unknown is where and how this system is deployed in Massachusetts. It's unlikely I'll get an answer from the MSP on this and since it's a passive system I can't go look up FCC licenses to get tower locations.

The only thing I do know is that it was used on June 3rd to identify at least one drone potentially by the State House and may have been used to identify a drone near the Governor's house earlier that day. Based on the dates in the PO it's also entirely possible that the MSP was using the existing "New England Aeroscope" system or the BPD system that may or may not exist*.

*Boston Police identified a drone operator on May 31st in Dudley Square Plaza and did solicit bids for their own G-8 system in January 2020.

With this information I can assume that either there is a G-8 system somewhere in the Boston Metro Area or they've got a mobile system and can deploy as necessary. I do know that a command post was set up at the State House during the protests and that the Governor lives in Swampscott. Assuming they've got a four antenna setup plugging that into Map Developers gives us this.

That means that the G-8 system could theoretically be anywhere within that circle give or take a few miles. One possibility is that it's at One Ashburton Place in Boston since that's where a transmitter for the MSP Statewide radio sytem lives but that's just wild speculation.

The other unknown is the New England Aeroscope MESH system. It apparently exists at least based on the RFR that was sent out. However I haven't been able to find any information on it aside from a bid (BD-19-1084-POLGH-GHQ-33656) from 2018 in COMMBUYS that references Aeroscope. When I try to access the bid I get the error "You are not authorized to access this resource." so that's fun.

Finally what the MSP actually bought is still murky. They either bought eight separate G-8 antennas or eight G-8 systems with four antennas each. On their website Gresco says that the "G-8 incorporates a four-panel array of high gain directional antennas". The DJI user guide for the G-8 mentions that each "box" contains four directional antennas.

The next step is to submit another batch of public records requests. Two to the Massachusetts State Police requesting information on the New England Aeroscope system and clarifying how many antennas they bought. Another to the Operational Services Division to get more information on the bid I can't access. The third is going to the Boston Police Department for information on the bid they have open for a G-8 system.

Here are the links to Muckrock if you want to follow along:

If and when I get records back from those requests I'll update this post.