What exactly is the ACARS Drama Bot Anyway?

Mike Sheward
5 min readAug 11, 2024

--

A question I’ve been asked a few times since I took a little project I had for a year or so operating privately under my desk, and turned it into a social media bot.

Note: this post is designed as a more high-level overview of what ACARS/VDLM2 messages are, and what my bot they feed is. So, if you’re looking for a more detailed technical overview of how the bot works, check out this earlier post.

When an aircraft is flying overhead, various radio signals are being transmitted and received by said aircraft constantly. Some examples of the radio signals of course, are voice communications between pilots and air traffic controllers, that most people are familiar with. These are of course critical for safety, and ensuring planes are at the right altitude, going in the right direction, and at the right speed.

In addition to voice, there are also a boat-load, well, plane-load I guess, of data signals. Amongst these data signals are the two types of signal that feed the bots insatiable thirst for drama. They are ACARS and VDLM2.

ACARS, which stands for Aircraft Communications Addressing and Reporting System, is a 1970’s era protocol that is still used today. A bunch of ground stations around the world are used to translate messages between computers in dispatch, maintenance and operations control rooms of the various airlines and their aircraft, and vice-versa, from the aircraft cockpit back to those airline computers.

VDLM2, which stands for VHF Data Link Mode 2, is similar in that it is a data transmission protocol that works over very high frequency (VHF) radio-waves, but its a bit more modern, uses different frequencies, is a bit faster, and can also carry ACARS messages.

So, in summary, ACARS is where the drama usually is, sometimes transmitted in raw ACARS form, other times it is encapsulated in VDLM2. Same result all round really, you just have to look in a slightly different place to decode the ACARS inside of VDLM2 messages.

Because I am a massive nerd when it comes to both radio stuff and planes (I was a PPL, almost did commercial but got rejected by the flight school I wanted to train at age 17 because I was ‘too quiet’, a problem I later rectified), I was able to buy a few relatively cheap bits of equipment that can listen for these signals from planes flying over my house, and using some open source software that other, much smarter people than me wrote, I was able to decode them. I then wrote some extra bits of software that fixes up the message (extracts only the human readable interesting bits, removes bad formatting etc), and turns it into the posts you see on ACARS drama. That software also does the job of finding the aircraft photo and adding the tracking link too.

Now, because of how the system works, it is extremely hard to capture the ground to air signals, unless you live in close proximity to an airport or ground station, which I do not. So this means that pretty much 99% of what you see on ACARS Drama is air to ground. Essentially one side of a converstation, from the plane to folks on the ground. Sometimes it picks up ground to air, but its rare, and I honestly don’t know why it works when it does. If you do see a ground to air message, the bot will say ‘ACARS Message To’ instead of ‘ACARS Message From’.

Because of the sheer volume of the messages it picks up, around 2,000 an hour, most of which are just position and weather data, and automated readings from equipment, it would not be reasonable to post them all via the bot. That would just be annoying. So, I have carefully curated a list of keywords that the bot looks for in the messages received, to ensure that it only shares the ones with human entered, ‘free-text’ content. So when you see a message on the bot, it means that a pilot or crew member on the aircraft typed that into their ACARS terminal, which is usually a Flight Management Computer (FMC) device, like the one below (read more here):

An FMC from a cockpit — source http://www.b737.org.uk/fmc.htm

These tiny buttons, and small screens also explain why their are so many typos and most of the messages are written in 1990’s SMS short code, btw lol, lmao, gr8.

As a message is typed and sent via ACARS, if that plane is in range of one of my antennas (there are two currently being used for the ACARS drama bot), and on a frequency I’m monitoring (I currently monitor five total — 3 ACARS and 2 VDLM2), then it’ll be processed by my software and turned into the bot post that you see on Masto like this:

VDLM2 Message From: N305SY / OO3682 — Message: PLAYING CATCH UP FROM EARLY DELAYS IN THE DAY

In this example, the message was captured in a VDLM2 frequency. The transmitting aircraft registration was N305SY, and it’s flight number was OO3682. OO is the code for Skywest Airlines, and N305SY is an Embrarer 175 aircraft. The Track Aircraft link in the bot points to the registration, so you can see whereabouts in the sky the plane is at any given time, unless its on the ground of course.

It’s fair to say, that the overwhelming majority of messages transmitted are extremely routine and boring, contrary to the name of the bot — which to be honest, is part of the joke. So, you’ll mostly see things about asking for gate confirmations, reporting ‘snags’ with the aircraft, usually toilet or coffee maker related, but occasionally you’ll see reports of drunk passengers, fights onboard — you know, air travel things. That’s what makes it an interesting and fun project. You also get to see the pilots personalities shine through as well, which I love. We all have good days and bad days at work, so you might see the occasional snarky message — but ultimately, these are professionals doing a wonderful job in not always the easiest of circumstances.

So thats what you’re seeing and how the bot works, you can follow along at https://infosec.exchange/@acarsdrama if you aren’t already.

--

--

Mike Sheward
Mike Sheward

Written by Mike Sheward

Information security professional specializing in SecOps, IR and Digital Forensics. Author of the Digital Forensic Diaries, and now, the Pen Test Diaries.