Threats to Global Navigation Satellite Systems

Originally developed to guide Allied convoys safely across the Atlantic, the use of synchronized low frequency radio signals as a navigational aid revolutionized modern maritime navigation in the 1940s.  Faced with operating ships and aircraft over vast areas, researchers pioneered the use of radio signals to aid navigation in regions where poor weather conditions made traditional methods—such as dead reckoning and celestial navigation—exceptionally difficult.  This system was eventually named LORAN.  When in range of three or more shore-based transmitters, LORAN receivers placed onboard ships and aircraft allowed operators to fix their location within minutes regardless of the weather.  The original system, known as LORAN-A, and its eventual replacement, LORAN-C, were operated by the U.S. Coast Guard and other nations until 2010.  The U.S. portions of the system were phased out in favor of the satellite-based Global Positioning System (GPS) which became operational in July of 1995.  The latest LORAN Position Navigation and Timing (PNT) system known as “eLoran” is currently in use or under consideration in several countries.   Eventually, Loran C systems throughout the world are expected to be replaced by eLoran. 
The impact of GPS on the commercial transportation industry has been enormous.  Everything that moves—ships, cars, trains, aircraft, and even farm equipment—is now navigated by GPS, or a similar GNSS system.  Companies worldwide use GPS to time- stamp business transactions, maintain records, and ensure traceability.  Major financial institutions use GPS to synchronize their computer networks around the world.  Large and small businesses now use automated systems that can track, update, and manage multiple transactions made by a global network of customers.  These systems require accurate timing information available through GNSS Systems such as GPS (National Coordination Office for Space-Based Positioning, Navigation, and Timing, 2014).

Reliance of the Maritime Industry on GNSS
The commercial maritime industry has become especially reliant on GNSS technology.  eCharts provide a continuous, real time plot of the true and relative movements of both the vessel and nearby objects often using radar images and Automatic Information System (AIS) transponder signatures superimposed on the electronic chart (see Figure 1).  Most merchant marine academies continue to teach their cadets skillsets such as how to fix a vessel’s position using terrestrial and celestial bearings. However, these techniques are less often used in the modern shipping industry, which continues to move irreversibly towards the use of fully integrated electronic bridges. Yet, in the event of GNSS compromise, these basic seamanship skills may be necessary to counter a cyber attack.
Several other satellite based PNT systems are also in operation.  In 1995, the same year that GPS became operational, the Russian Federation announced deployment of GLONASS.  This system has been hampered by uneven funding and suffered a well-publicized 11-hour service outage in April 2014, among other failures.  In Asia, China plans to deploy its BeiDou-2 (formerly known as COMPASS) satellite navigation system.  The BeiDou-1(BDS) system currently provides only regional coverage, however China has announced plans to provide global coverage by the year 2020.  In Europe, the European Space Agency (ESA) continues development of the Galileo satellite navigation system.  When complete, Galileo will provide low precision PNT services to the general public, while high precision services will be available for a fee to commercial and military subscribers.

GNSS Signals
Signals produced by PNT satellite systems range between 1162 and 1610 MHz (see Figure ).  U.S. GPS emits two types of signals: one which is broadcast on a single frequency and available free to all users; and a second signal which is broadcast on a separate encrypted frequency available only to the military. These two signals, are equally accurate. However the availability of the second signal on a different frequency allows the military to compensate for naturally occurring interference within the ionosphere, resulting in a more accurate fix and greater system resiliency.It is important to note that GNSS pulses are extremely weak.  GPS signals have been compared to the light emitted by a “40 Watt light bulb as seen from 11,000 miles away (17,700 km)” (Daniels, 2014).  As such GNSS signals are vulnerable to:

(1) Jamming and Interference.  The broadcast of a stronger signal that intentionally or unintentionally blocks or impacts a GNSS satellite signal;

(2) Spoofing.  The broadcast of a false GNSS signal, but at a slightly greater power which deceives the GNSS receiver into locking onto the spoofed signal.  A spoofing attack can be very difficult to detect.

(3) Meaconing.  The intentional delay and rebroadcast of a GNSS signal intended to introduce error to receivers;

(4) Extreme Space Weather (ESW).  Solar activity such as solar flares, coronal mass ejections, high-speed solar wind, and the impact of energetic particles on the earth’s ionosphere.

(5)  Other Vulnerabilities.  Kinetic or laser attacks to the satellite constellations or collisions with space debris are a few of other known susceptibilities of GNSS. 

Shipboard Systems Affected by the Loss of GNSS Signals
A significant proportion of navigation equipment on the bridge of a modern ocean- going commercial vessel (see Figure 3) and various offshore energy platforms will likely be affected by the loss of GNSS signals.
For the components listed above, the loss of GNSS may not prevent the component from functioning through an alternate sensor input.  However, tests conducted by the General Lighthouse Authorities (GLA) of the United Kingdom and Ireland in 2008 showed how easily error messages and auditory warnings prompted by the loss of GPS can easily distract (and overwhelm) a vessel’s bridge team (Grant, Williams, Ward, & Basker, 2008).  This can be especially dangerous for vessels operating in confined waterways, near shallow areas, or maneuvering in higher traffic densities. 
These vulnerabilities are not unique to the maritime industry.  A number of other industries are also at risk.  For instance, the aviation and financial industries are heavily dependent on properly functioning PNT systems and would be affected in varying degrees by a cyber-attack on GNSS.
Largely unique to the maritime industry however, is that much of marine environment information transfer is via radio frequency (RF) and not a dedicated hard-line network or directional microwave dish.  A good example of this type of transfer is positioning signals by satellite systems.  Data being sent to and from shipboard computers along with other shipboard technology is cyber; therefore interference with the data flow constitutes a cyber threat.  Ergo, a Maritime Cyber Security (MCS) issue.
 

GNSS Jamming Equipment
With some exceptions, use of GNSS jammers is generally illegal in the U.S., Canada and Europe. Despite this, jammers of various sizes and power ratings (see Figure 5) are available via the internet.  These small handheld jammers are extremely difficult for law enforcement officials to locate and suppress because they can be used intermittently, disguised or hidden easily, are highly mobile, and if necessary disposed of quickly by perpetrators.
Advanced GPS receivers are more resistant to jamming than conventional designs.  For example, receivers equipped with nulling antennas are more resistant to jamming than receivers without them (Jones, 2011). 
Figure 5 shows the area affected by a GPS jammer during tests conducted at Bridlington, U.K. along the coast of the North Sea in 2008.  During the test a jamming unit was positioned 25m above ground level with a maximum power of 1.58 watts.  These tests demonstrated that relatively small jamming units can effect GNSS reception over great distances (Grant, Williams, Ward, & Basker, 2008).

Threat Scenarios
At this time, the three most likely GPS maritime cyber threat scenarios to consider are:

• Jamming of a port or other congested waterway by an individual or small group of non-state actors using small, portable jammers.  Rapid movement of these individuals, coupled with intermittent use of the jammer(s) would make it very difficult for local law enforcement officials to track and arrest the perpetrators quickly.  Attacks of this type can lead to significant economic losses as well as loss of confidence by system users.  

• State-sponsored GNSS Jamming.  The most well documented examples of state sponsored jamming attacks occurred in the Republic of Korea (see Table 1).  On three different occasions, the Republic of Korea was subjected to intentional, high-power jamming by North Korea over a wide area.  The source of these attacks appear to have been large truck-mounted jamming units placed at strategic geographic locations (Figure 6).  Amongst the many attacks, the 2012 attack affected over 1000 aircraft and 250 ships (Seo & Kim, 2013).

• State-sponsored Spoofing.   Eventually, spoofing may pose a significant maritime threat to GNSS as it has the potential to lead vessels astray into dangerous waters, resulting in significant loss of life (cruise liners and ferries) or environmental damage.  Presently, spoofing requires a level of technical sophistication that is normally presented through nation states.  However, small groups have conducted successful spoofing tests, most notably students at the University of Texas under Professor Todd Humphreys.             

Primary Defenses Against Jamming
• Improved Maritime Training and Education.  Ship crews should be taught how GNSS systems interact with ship systems and how to recognize when GNSS signals may have been compromised.  The maritime industry should also be encouraged to maintain basic seamanship skills, such as dead reckoning and the ability to use piloting instruments.  Routine ship drills should include signal loss and spoofing of the signal.

• Improved Equipment.  Development continues on new GPS receivers that can identify non-GPS signals by their relative location (jamming and spoofing signals come from the terrestrial locations not satellites) and their strength (jamming and spoofing signals must by necessity be stronger than GPS satellite-generated signals).  In addition to receiver signal strength alarms and specialized antennas, the effects of intentional jamming could be mitigated through the use of inertial navigation systems (INS) and radio frequency (RF) jamming detectors.  However, at this point in time it is unclear when such equipment would be available to and employed by the commercial industry, or how much it will cost.

• Installation of Powerful Alternate Ground Based PNT Systems.  Coastal nations most at risk should consider the installation of alternate (back-up) or complementary, land-based PNT systems, such as enhanced LORAN (known as eLoran).  Rather than purely “back-up”, it is “complimentary” in that the low frequency of the powerful eLoran signals permits PNT reception in GNSS denied environments.  However, the main benefit of such systems is to provide PNT users with a second and more resilient PNT signal – one that is too powerful to be effectively jammed or spoofed.          

Recommendations
Worldwide dependence on Global Navigation Satellite Systems (GNSS) continues to grow.  Ongoing advancements in jamming technology and the availability of small, portable jammers constitute a significant threat to maritime commerce and safety.  In the face of a GNSS jamming attack, most commercial ports could be forced to suspend operations until the source of the interference is located and suppressed.  It is very possible that a group of individuals operating small, portable jammers could force the closure of a major seaport or international maritime chokepoint.  The economic consequences of such an attack could run into the billions of dollars.
In the long-term we also anticipate that more powerful jamming technology and delivery systems (such as broadband jammers and drones) will become widely available and constitute two of the greatest threats to GNSS. The maritime community needs to become more vigilant, actively train to recognize and respond to cyber attacks including jamming and spoofing, and encourage the immediate installation of complementary PNT systems such as eLoran for strategic maritime locations.

The Authors

CAPT David Moskoff:
Captain David B. Moskoff is a professor in the Marine Transportation Department at the U.S. Merchant Marine Academy. He is an expert on maritime cyber security.

Mr. William Kaag:
Mr. Kaag is a retired Naval Aviation Supply Officer and a past research fellow at the Maureen and Mike Mansfield Foundation.  He specializes in maritime logistics and international emergency preparedness. 

The views expressed do not necessarily represent those of either of their agencies or the United States.
 

(As published in the May 2015 edition of Maritime Reporter & Engineering News - http://magazines.marinelink.com/Magazines/MaritimeReporter)