GPS Jamming vs

GPS Spoofing

18 OCTOBER 2023
Aircraft navigation has come a long way with the There are several types of threat that can interfere
advent of global navigation satellite systems (GNSS), with a GNSS receiver’s ability to receive and process
first devised by the U.S. military in the 1960s. The GNSS signals, giving rise to inaccurate readings, or
arrival in the mid-1990s of the civilian version of the no reading at all, such as radio frequency
technology, called the Global Positioning System, interference, space weather induced ionospheric
meant that aircraft could navigate by satellite and interference, solar storm, jamming and spoofing. The
take direct routes from point to point. The GNSS disruption of GNSS, either performance degradation
receiver is the primary equipment supporting in terms of accuracy, availability and integrity or a
Required Navigation Performance (RNP) operations complete shutdown of the system, has a big
and provides position input to many aircraft avionics, consequence in critical infrastructure.
such as Navigation Display (ND), Ground-Proximity
Warning System (GPWS) and Automatic Dependent
Surveillance (ADS). Some business aircraft are
referencing GNSS for flight control and stability
systems.

GNSS satellite constellations which are currently

recognized by International Civil Aviation
Organization (ICAO) include the US. Global
Positioning System (GPS), the Russian GLONASS,
the European Galileo and the Chinese BeiDou.
Frequencies for GNSS signals supporting safety-of-
life applications, such as aviation, are globally
harmonized and legally protected under the
International Telecommunication Union (ITU) Radio
Regulations. Aircraft GNSS receiver is a safety-
critical equipment and the main source of position
information which drives aircraft navigation system in
most commercial aircraft.

© ICAO

GNSS Anomaly for the Period January 2015- June 2018 (MID Region) - ICAO

19 OCTOBER 2023
GPS Jamming Radio Frequency Interference (RFI)

The GPS signal is a low power signal. It is

GNSS Jamming occurs when broadcasting a strong comparable to the power emitted by a 60W light-bulb
signal that overrides or obscures the signal being located more than 20,000 km away from the surface
jammed. The jammer will confuse the receiver by of the earth. This means that the signal could easily
emitting radio signals at the same frequency as the be disturbed by any ground source located near an
GPS. This interference hampers the ability of the aircraft and emitting in the GPS L1 frequency band
GPS device to determine its correct position. The (1575.42 MHz +/-10 MHz). Main Known Sources of
GNSS jamming might occur deliberately by a military RFI are:
activity or by other sources.
Personal Privacy Devices (PPD)
Other GNSS systems, such as Russia's GLONASS, These Devices jam a GPS signal in the immediate
China's BeiDou, and Europe's Galileo constellations, area to avoid tracking.
use slightly different frequencies but have similar
vulnerabilities, depending on exactly who is Protection of sensitive sites and VIPs
conducting the test or attack. Certain sensitive sites may be protected using GNSS
RFI for security reasons.
In 2017, the FAA commissioned the nonprofit Radio
Technical Commission for Aeronautics to look into GPS repeater
the effects of intentional GPS interference on civilian GPS repeater signals have caused interference with
aircraft. Its report, issued the following year, found actual GPS signal in some reported events.
that the number of military GPS tests had almost
tripled from 2012 to 2017. In at least a handful of TV broadcast station malfunction
episodes, the loss of GPS was deemed an A TV broadcast station malfunction reportedly
emergency. disturbed the GPS signal.

Military GPS RFI in conflict zones

These areas are often close to military conflict zones
The GPS technology today found in airplanes and known via NOTAMs
and consumer equipment was designed by the
U.S. military, for the U.S. military to locate and
navigate its aircraft, ships, tanks, and troops.
The U.S. military routinely jams GPS signals
over wide areas on an almost daily basis.
© Airbus

20 OCTOBER 2023
 Hand-Held Jammers

A hand-held GPS jamming unit is generally small and

self-contained, so the user can readily transport and
hide it. These Jammers are prompt to start up and
are usually ready to operate in just a few seconds.
They also use relatively little power. That makes them
easy to turn on when needed and switch off quickly to
avoid detection. What's more, these illegal devices
are readily available on the black market for prices
nearly anyone can afford. Some of these sources are
also capable of emitting signals that mimic GNSS
signals (GNSS Spoofing, discussed later).

Building a basic electronic warfare setup to

disrupt these weak signals is trivially easy. “Just
Detune the oscillator in a microwave oven and
you've got a super powerful jammer that works
A typical handheld GPS Jammer over many kilometers", said an expert.

© GPSJam

21 OCTOBER 2023
GPS Spoofing Carry-Off Attacks

This type begins with the attacker broadcasting

While GPS jamming is something anyone can do with signals that sync perfectly with the target receiver's
relative ease, GPS spoofing, until now was primarily legitimate signals. The attacker then gradually
the work of military operations. GPS spoofing is the increases the power of the signal until it essentially
term given to attacks in which hackers transmit GPS- drowns out the genuine one, causing the receiver to
like signals and code them in a way that tricks track the false signal instead. At that point, the
receivers into thinking they are in a different location attacker can manipulate the signal so the receiver
than they are. Someone conducting a spoofing attack reports a different location or time than the real one.
is trying to lie to a GPS receiver through the The goal of carry-off attacks is to evade detection,
broadcast of incorrect signals disguised as typical making them primarily the domain of military
ones. It's also possible to conduct a spoofing attack operations.
by broadcasting genuine signals with the wrong
timestamp, or signals captured at a different location. Meaconing
The spoofer then modifies these signals to make the
receiver believe its position is in a different location,
In this form of GPS spoofing, the signals get re-
or in the right place at the wrong time. GPS Spoofing
transmitted, rather than altered. GPS repeaters are
can be done in two ways:
often the source of meaconing, whether intentional or
not. An example of a repeater is the equipment found
in airport hangars that allows the detection of GPS
The GPS technology today found in airplanes signals indoors, usually for testing. If someone
and consumer equipment was designed by the increases the power of one of these repeaters —
U.S. military, for the U.S. military to locate and accidentally or on purpose — the result will be the
navigate its aircraft, ships, tanks, and troops. broadcast of an incorrect signal.
The U.S. military routinely jams GPS signals
over wide areas on an almost daily basis.

© GPS Patron

22 OCTOBER 2023
On Aug 29, 2023, Gulfstream G650 in the vicinity of The IRS is Standalone – How Can it be Affected?
ORER (Erbil, Iraq) lost navigational integrity over
nearly entire Iraqi airspace due to enroute high In the past, INS and IRS were fully self-contained
altitude GPS spoofing (Falsified position not jammed systems. However, the technology in the flight deck
as usual). Aircraft then entered full degrade. GPS is now far more integrated. Many modern IRS
was 60NM offset, the IRS were considered systems use GPS to update the accuracy of the IRU
unreliable. Situation was resolved by receiving radar as the flight progresses.
vectors by ATC to fly along the airway. UM688
RATVO to VAXEN, overhead ORBR and close to In general, the system is designed so that if there is a
ORER at 15:50Z. GPS Signal that was emitted was loss of signal or a suspected loss of integrity of the
very strong and could be picked up by both hands GPS calculated position, then the IRS solution will be
held EFB moving maps. Due to the strength of the isolated and the plane will use the most recent DR
falsified GPS signal, the GPS was considered valid solution. If however the system cannot tell it has a
by the aircraft system causing the large mismatch. bad position solution due to sophisticated spoofing, if
(OPS Group) might well go ahead and update the IRS with bad
data.

FMS and IRS have only been designed to cope with a loss of GPS signal, and not an intentional spoofed signal.
Most airliner avionics system know that a shift/gross-error has happened as ground-based updates do not
compute the correct position, and will flag a navigation/map/position warning. However, all primary navigation
systems end up being corrupted (temporarily) as a result.

23 OCTOBER 2023
Recommended Procedure
Before Entering Risk Area

Check enroute FIR NOTAMs for any GPS If active spoofing/ Jamming confirmed:
spoofing/Jamming advice (in time this will likely
be published)
Revert to heading mode
Cockpit Preparation: Perform full IRS alignment if
De-select GPS inputs as soon as possible (IRS
entering known area with GPS spoofing risk
infection is not immediate)
Be aware of typical sensor hierarchy for FMS
Confirm IRS integrity
position: GPS, then IRS, DME/DME, VOR/DME,
Consider using OFP/CFP computed track
DR.
between waypoints as guidance
Consider de-selecting GPS sensor input if option
Report to ATC so other aircraft is aware, and
available (Check respective FCOM)
check position.
Review differences between GPS Jamming and
Remain IRS only until clear of risk area
GPS Spoofing.
Perform time check and set correct time on
personal device or watch. After Flight with Suspected
Spoofing/Jamming
Inside Active GPS Spoofing/Jamming
Report to Maintenance
File report to your civil aviation authority
Look for clues that the aircraft may be
being targeted:

Large increase in EPU (eg. 1-2nm to 60nm)

Aircraft clock changes – incorrect UTC time
Incorrect FMS position
Large shift in GPS position displayed
Obvious ND/PFD warnings about position error
Other aircraft on ATC freq/121.5/air-to-air report
clock issues, position errors, or request vectors.

24 OCTOBER 2023
Conclusion Credits
GNSS Vulnerability has been identified as a safety https://spectrum.ieee.org/faa-files-reveal-a-
issue and one of the main challenges impeding the surprising-threat-to-airline-safety-the-us-militarys-
implementation of PBN. While GPS jamming or gps-tests
spoofing incidents typically always indicate malicious
intent, aviation cybersecurity teams face an uphill https://ops.group/blog/gps-spoof-attacks-irs/
battle in defending the onboard component. A
completely unprotected GNSS receiver is susceptible https://www.duncan-parnell.com/blog/whats-the-
to attacks of even the simplest caliber, but difference-between-gps-spoofing-and-jamming
fortunately, a variety of secured receivers can alert
people and organizations to spoofing. They do this by
searching for anomalies in the signal, or through the
use of signals specifically created to make spoofing
more difficult.

Just like other operational risks, this requires

continuous monitoring and the execution of response
plans. The bottom line is that through collaboration
and impactful guidance, we can collectively address
GPS concerns.

25 OCTOBER 2023