The imitation game
Instances of GNSS spoofing are on the rise, especially near nation-state conflicts, but the threat is spreading to areas of non-active skirmishes.
The use of Global Navigation Satellite Systems (GNSS) enhances performances in aviation. GNSS is the standard generic term for such systems that provide users with positioning, navigation, and timing (PNT) services. GNSS based technologies are now widely used for aircraft navigation for different phases of flight including departure, En Route and approaches.
The term includes the US Department of Defense’s Global Positioning System (GPS). Indeed, given its prevalence, GNSS and GPS are used interchangeably, but there are other regional systems including the Chinese government’s BeiDou Navigation Satellite System (BDS), formally called Compass, the European Union’s (EU) Galileo, the Russian Federation’s GLONASS, the Indian Government’s IRNSS and Japan’s QZSS.
Speaking in January 2024, the then EASA Acting Executive Director Luc Tytgat stated that, “GNSS systems offer tremendous advantages to aviation in increasing the safety of operations in a busy shared airspace.”
However, he also noted that there had been “a sharp rise in attacks on these systems, which poses a safety risk. Countering this risk is a priority for the Agency.”
For Mark Watson, Technical Programme Manager at EUROCAE, the recent spike in Radio Frequency Interference (RFI) events, affecting aviation users of GNSS, highlights the vulnerability of the Communication, Navigation and Surveillance (CNS) infrastructure.
“One of the main weaknesses of current GNSS technologies is its low received signal power which are jammed or spoofed daily in some regions of the world. With the increasing usage of GNSS for aviation, it clearly appears that resilience of airborne equipment to such threats is strategical for operations availability and continuity while maintaining the required integrity and accuracy,” he states. “Beyond that, multiple systems, both in aircrafts and in CNS ground infrastructure, make use of GNSS time outputs, reinforcing the need for resilient GNSS signals.”
What’s in a name?
As Adam Price, Vice President – PNT Simulation, Spirent Communications, FRIN explains, GPS jamming and spoofing are both classified as forms of interference, but the mechanisms and the impacts can differ significantly. In simple terms, jamming involves overwhelming a receiver with noise, rendering it unable to process the desired signals.
As others note, it is relatively easy to employ and with the low cost of jamming equipment coupled with its diminishing size makes acquiring and delivering jamming devices, including by using inexpensive drones, an increasing concern.
Recently, an EU spokesperson confirmed that the GPS system of European Commission President Ursula von der Leyen’s airplane was jammed while en route to Bulgaria. Bulgaria’s government said the GPS signal was lost as von der Leyen’s plane approached the southern city of Plovdiv, prompting air traffic controllers to switch to ground-based navigation systems to ensure a safe landing.
GPS spoofing is the deliberate transmission of counterfeit GNSS signals to deceive GNSS receivers, causing incorrect position, navigation, and timing data.
According to Price, the first thing to state here is that we are talking about spoofing at RF. He says that another form of spoofing, and one that may become more prevalent as RF architecture is hardened, is a man-in-the-middle attacks. This resembles a traditional cyberattack, wherein an attacker gains a device and manipulates the signal processing or receiver output. In this case, no false signals are required at all.
“Looking at the increasingly common and better-understood RF spoofing attacks, these can be broken down into a number of different forms,” he explains. “Meaconing is the rebroadcasting of real GNSS signals, where the delay in broadcast causes error in the receiver under attack. Code carrier attacks involve the malicious broadcast of synthetic GNSS signals. An asynchronous (non-coherent) attack is simply a broadcasting of false independent signals in order to manipulate the PVT (Position, Velocity and Timing) solution of unprotected receivers. Synchronous (or coherent) code carrier attacks synchronise signal timing and navigation data with the real signals before the fake signal is broadcast. This can make them much harder to detect.”
Price adds that while there is a clear difference in terms of the attack vector, it should be noted that the impact can sometimes be more grey. “As an aircraft – for instance – moves towards or away from a jammer, there’s often a point at which the jammer-to-signal ratio is too high for the receiver to function properly, but not high enough to completely knock it out,” he says. “In such cases, receivers can report behaviour similar to a spoofing attack – outputting inaccurate and misleading data, rather than no data.”
And while in very recent years, GNSS jamming and spoofing incidents have increasingly threatened the integrity of PNT services, they are not a particularly new threat to aviation.
Writing in a 2003, Los Alamos research paper (LAUR-03-6163), Jon Warner and Roger Johnston, then members of the Vulnerability Assessment Team at Los Alamos National Laboratory, pointed out that “receivers are generally aware of when blocking or jamming is occurring because they have a loss of signal. Spoofing, however, is a surreptitious attack.”
Clear and present danger
Benoit Figuet, Co-founder of SkAI Data Services, which contributed to the OPSGROUP GPS Spoofing workgroup, says the risk is now operationally significant for civil aviation. In a survey by OPSGROUP of nearly 2,000 flight crew, 70% rated their concern over GPS spoofing’s impact on flight safety as “very high” or “extreme” with 91% expressing at least moderate concern.
In collaboration with SkAI Data Services, researchers at the Zurich University of Applied Sciences – Centre for Aviation have developed a GPS spoofing tracker, GPSwise,that uses ADS-B data obtained via the OpenSky Network to identify potentially spoofed aircraft. This spoofing tracker displays the position of potentially spoofed aircraft on an interactive world map in real time and enables users to obtain an up-to-date picture of the situation.
In terms of how serious the risk is, Price says he doesn’t want to catastrophise. “For all the talk of autonomous systems, there aren’t many navigation systems operating entirely without human oversight. Spoofing alone isn’t likely to cause planes to crash into terrain or cars to propel themselves into lakes, but the impacts can be serious. Operational efficiency has been compromised in aviation, and safety-critical systems such as ILS and ADS-B have been rendered unreliable or unusable. Even toilets have stopped operating as a result of GPS interference. Ultimately, the impact of spoofing is that systems we have come to trust and to rely on cease to be trustworthy or reliable.”
Although GNSS jamming and spoofing can be encountered anywhere in the world, Figuet says that interference is most often reported around active or latent conflict zones. These include near Russia/Kaliningrad, the Black Sea region, the Middle East (notably near Israel and Syria), the India–Pakistan border, Myanmar, and recently, the Persian Gulf. “But sometimes we observe interference in areas without active conflict like Hong Kong, Mexico or parts of the United States,” he says.
The impact of a spoofing attack on equipment can range from obvious to insidious, and as EASA spokesperson Janet Northcote says interference can occur during any phase of flight, leading to re-routing or diversions to ensure safety. Common symptoms of GNSS spoofing include discrepancies in navigation positions, abnormal differences between ground speed and true airspeed, time shifts, spurious terrain awareness and warning system (TAWS) alerts and potential deviations in hybrid positions (inertial reference system (IRS)/GNSS).
Price expands further. “A basic, asynchronous spoofing attack – if successful – would likely show significant jumps in position, and motion patterns that do not align with what a pilot is seeing. For instance, a common attack is what we call “circle spoofing”, where the vehicle appears to be moving in a circular motion. Another common attack is to alter the calculated position to a restricted area, such as an airport – useful when drones are targeted, as the geofencing software that many commercial drones run will automatically ground itself if it believes it is in restricted airspace. In these cases, a pilot should hopefully be able to recognise that they are either not moving in a circle or not flying at low altitude over an airport”
With a synchronous, targeted attack, Price says the signs of being spoofed can be so small as not to be noticed. “The vector involves matching the real signals, so, at first, the spoofed aircraft would continue to show correct position and velocity information. If the false information is applied carefully, it’s likely that a number of commercial receivers would not signal an alarm that they are being spoofed, and the changes in course, velocity or time would not be easy to determine for a pilot with no alternative reference data.”
He believes that time is the often element overlooked as it is not immediately visible to the pilot or user. As GPS time is often now the reference time source for multiple transport systems, the timing error from a spoofing attack will often manifest itself in a failure or ‘false warning’ from another instrument beyond its core navigation. This could be a false aircraft collision warning or a ground proximity warning.
“Thankfully, modern aircraft are equipped with multiple sensors and means to determine position, velocity and altitude. By using a ‘multi-layered’ approach with PNT systems (for example Intertial, Ground based RF and GNSS together), experienced pilots are equipped to manage many of the interference events they witness. Therefore, one of the key short-term aims is to ensuring safe mitigation procedures and policies are in place for flight crew,” he says.
At a general level, Northcote says that EASA has recommended airlines to specifically consider the following:
Specific recommendations for air operators
For jamming:
- Verify aircraft position using non-GNSS means.
- Check critical navigation aids; and
- Report irregularities.
For spoofing:
- Monitor aircraft position using non-GNSS navaids.
- Closely follow air traffic control (ATC) frequencies.
- Apply manufacturer instructions on detecting and dealing with suspected GNSS spoofing; and
- Report irregularities.
“While these events can present a challenge to flight safety, there are mitigations in place to ensure safety is maintained in such circumstances,” she says. “If GPS fails, or when pilots identify that a signal is being spoofed or jammed, there are other systems both onboard the aircraft and on the ground that pilots can rely on to continue the flight safely.”
“By all accounts, the impact of RFI on GNSS is collateral,” says Watson. “No conflict party appears to be disrupting air traffic intentionally; instead, RFI is a weapon in electronic warfare, recklessly reducing the safety margins of operations in the affected areas.”
But efforts are being made to tackle the risk specific to incidents of GNSS spoofing and jamming.
Collaborative action
Northcote says that EASA is continually monitoring the situation, particularly using reports provided by air operators on actual situations encountered. In June 2025, EASA and the International Air Transport Association (IATA) outlined a comprehensive plan to mitigate the risks of GNSS interference. This was the outcome of an industry workshop held the previous month in Cologne, Germany.
The workshop concluded that four workstreams are critical:
- Enhanced Reporting and Monitoring
The workshop resolved to agree on standard radio calls for reporting GNSS interference and standardised notice to airmen (NOTAM) coding, i.e. Q codes. It is also raised the need to define and implement monitoring and warning procedures, including real-time airspace monitoring, and ensure dissemination of information without delays to relevant parties for formal reporting. - Prevention and Mitigation
The workshop agreed on the need to tighten controls (including export and licensing restrictions) on jamming devices and to support the development of technical solutions to reduce false terrain warnings; improve situational interference with portable spoofing detectors; and ensure rapid and reliable GPS equipment recovery after signal loss or interference. - Infrastructure and Airspace Management
It was decided to maintain a backup for GNSS with a minimum operational network of traditional navigation aid and better utilise military air traffic management (ATM) capabilities, including tactical air navigation networks and real-time airspace GNSS incident monitoring. In addition, enhancing procedures for airspace contingency and reversion planning so aircraft can navigate safely even if interference occurs. - Coordination and Preparedness
Improvements to civil-military coordination, including the sharing of GNSS radio frequency interference (RFI) event data were necessary as were preparations for evolving-threat capabilities, also for drones.
Speaking at the time of the plan’s publication, Jesper Rasmussen, EASA Flight Standards Director, stated, “GNSS disruptions are evolving in terms of both frequency and complexity. We are no longer just containing GNSS interference — we must build resilience. The evolving nature of the threat demands a dynamic and ambitious action plan.”
Watson highlights the growing number of activities ongoing at EUROCAE, to enhance the resilience of navigation services to GNSS RFI.
This includes the new DFMC SBAS standard (ED-259A “Minimum Operational Performance Standard for Dual-Frequency Multi-Constellation Satellite-Based Augmentation System Airborne Equipment”), developed by EUROCAE WG-62 GNSS, and released in October 2023, which has brought additional robustness against RFI and added new features to detect and report RFI to aviation stakeholders.
He explains that ED-259B “Minimum Operational Performance Standards for Galileo – Global Positioning System – Satellite-Based Augmentation System Airborne Equipment”, currently under development, will support the use of dual frequency GPS and Galileo in civil aviation applications including Satellite Based Augmentation System (SBAS) and Advanced Receiver Autonomous Integrity Monitoring (ARAIM) augmentation capabilities, with enhanced robustness to RFI and Galileo OSNMA (Open Service Navigation Message Authentication) processing capability.
Another example of EUROCAE support to these urgent technical matters is the new WG-133 GNSS Multi Elements Antenna, which is a direct response to the GNSS signal degradations caused by jamming and spoofing, posing a significant concern for aviation safety. Thanks to an initiative by the EU Agency for the Space Programme (EUSPA), this new Working Group will develop antenna requirements, specifically Controlled reception pattern antennas (CRPA), to increase GNSS reliability and resilience.
A viable long-term solution could also be to enhance resilient, secure navigation systems designed specifically for civil aviation, adequately integrated with GNSS, which is precisely what the updates to EUROCAE WG-85 4D Navigation and ED-75 “Minimum Aviation System Performance Standards – Required Navigation Performance for Area Navigation” and ED-323 “Minimum Operational Performance Standards – Required Navigation Performance for Area Navigation” will accomplish.
There is no single, universal solution, but for Figuet, there are several promising measures are in progress.
These include Controlled Reception Pattern Antennas (CRPA) which can help filter out signals from illegitimate sources and Galileo OSNMA (Open Service Navigation Message Authentication), which provides authentication that may prevent spoofing of Galileo signals. “While it doesn’t remove the threat, integrating GPSwise “GPS weather” data into pilot EFBs enables crews to anticipate interference areas and prepare for it.”
Other attempts are being made too. In June this year, Shift5 and Avionica announced a partnership to deliver Shift5’s advanced GPS integrity solutions to commercial aviation, monitoring GPS signals for spoofing and jamming attempts and delivering alerts through existing operator interfaces.
According to the company, the Shift5 GPS Integrity Module provides advanced, multi-faceted detection and alerting for GPS spoofing and jamming attempts. It uses data collected from onboard systems, to assess position changes and alert operators about any anomalies using algorithmic position analysis to identify movements that are not physically possible and checking for significant position deviations, and GPS data validation, which compares GPS data with other onboard sources to validate the accuracy of GPS information. Any discrepancies can signal GPS spoofing, Shift5 says the module, customisable to work with any platform, enhances situational awareness by delivering direct alerts for GPS spoofing attempts, and helps facilitate a more efficient and secure decision-making process in the cockpit. With immediate notifications, operators can quickly and accurately initiate Standard Operating Procedures (SOPs), such as deactivating the GPS to prevent it from corrupting other interconnected navigation systems, like the inertial navigation system.
Safe mitigation
When it comes to addressing challenges such as GNSS spoofing, one of the most important best practices is to start with standardisation. As Watson notes, commonly agreed standards provide a trusted framework to ensure that mitigation measures are interoperable, scalable, and aligned with safety and regulatory requirements.
“For this reason, it is essential that experts in this field actively contribute to the work of EUROCAE. By joining and engaging in our Working Groups, they can bring their technical expertise to the table, helping to shape practical and effective solutions that the entire industry can adopt. EUROCAE activities are open to all stakeholders, including military.” The full EUROCAE work programme can be found on its website.
Figuet believes the industry should maintain situational awareness and clear crew procedures for suspected spoofing or jamming event and preserve and invest in ground-based navigation infrastructure to ensure resilience.
For Price, the fundamental part of all mitigation strategies is testing. “Understanding how existing equipment behaves in the face of different kinds of spoofing attack is critical to understanding the level of risk being taken on,” he stresses. “Testing is, for the same reasons, the cornerstone in evaluating and integrating the new technologies that may nullify the threat of interference in the longer term. A common test vector is to use controlled jamming and spoofing attacks in a controlled secure lab environment to a navigation system under test. This can allow the user to assess the resilience and robustness of the navigation system, plus evaluate its ability to mitigate the threat by switching to other signals and sensors as mentioned previously.
Based on this testing, the clear next step should be to train air and ground crews in how to deal with the impacts shown in the testing. Whether that is training on how to reset GPS equipment, or training in how to recognise attacks, this again lowers risk.
By following such recommendations and maintaining vigilant monitoring, the aviation industry can mitigate the risks associated with GNSS jamming and spoofing, ensuring continued safety and reliability in air navigation and operations.
By Alex Preston
