GNSS and link attacks

Why this matters

GPS signals reaching the ground are extremely weak. IS-GPS-200N specifies a minimum received power of −158.5 dBW, or −128.5 dBm, for the L1 C/A signal, below the background noise level. Receivers need processing gain to pull the signal out. A transmitter of just a few milliwatts can drown it over a wide area, and anyone who can transmit a convincing imitation can deceive the drone about its position. A medical delivery route passing over communities needs to know what can happen and how to detect it.

Jamming

Jamming means transmitting energy in the same band until the receiver can no longer separate the signal. The metric is J/S, the jammer power relative to the wanted signal (dB). When J/S exceeds what the receiver tolerates, it loses track of the satellites. That tolerance depends on the receiver model, antenna and protection techniques, so it must come from manufacturer documentation or authorised laboratory testing.

Free-space path loss, following ITU-R P.525, increases by 6 dB every time the distance doubles.

import math

F_L1 = 1575.42e6     # Hz
S_GPS = -128.5       # dBm minimum L1 C/A received power per IS-GPS-200N
P_JAM = 10.0         # dBm (10 mW) omnidirectional
JS_LIMIT = 40.0      # dB assumed receiver tolerance

def fspl_db(d_m):
    return 20 * math.log10(d_m) + 20 * math.log10(F_L1) - 147.55

for d in (100, 500, 1000, 2000, 5000):
    js = P_JAM - fspl_db(d) - S_GPS
    print(f"{d:>5} m: J/S {js:5.1f} dB  {'lost' if js > JS_LIMIT else 'tracking'}")
radius = 10 ** ((P_JAM - S_GPS - JS_LIMIT - (20 * math.log10(F_L1) - 147.55)) / 20)
print(f"radius where J/S reaches {JS_LIMIT:.0f} dB: {radius:,.0f} m")

  100 m: J/S  62.1 dB  lost
  500 m: J/S  48.1 dB  lost
 1000 m: J/S  42.1 dB  lost
 2000 m: J/S  36.1 dB  tracking
 5000 m: J/S  28.1 dB  tracking
radius where J/S reaches 40 dB: 1,274 m

C2 links can be jammed on the same principle, except that C2 signals are much stronger than GNSS. The effect of C2 jamming is a lost link, which needs the lost-link procedures of UAT 312 and Module 3.

Spoofing

Spoofing means transmitting signals that look like real satellites so the receiver computes the wrong position or time. Humphreys et al. (2008) built a portable spoofer that starts by matching the real signals and then drags the solution away gradually, so the receiver sees no sudden jump. Kerns et al. (2014) extended this to capturing drones, analysing the conditions under which a spoofer can dictate the drone’s position and velocity estimates; in a field test they caused a small rotorcraft to lose its way and crash.

Covert capture is more dangerous than jamming, because the drone still believes it knows where it is and never enters a failsafe mode.

Detection by sensor consistency

The core idea is to compare GNSS with a source the spoofer cannot reach, such as dead reckoning (DR) from the IMU, air data or visual odometry. If the difference exceeds what DR error can explain, GNSS is suspect. Groves (2013) describes this as consistency checking in multisensor navigation.

import math

DR_DRIFT = 0.05                    # m/s dead-reckoning drift
SPOOF_START, SPOOF_ACC = 20, 0.02  # s, m/s² covert position drag
LIMIT = 5.0                        # m alarm threshold

for t in range(0, 61):
    dr_err = DR_DRIFT * t
    offset = 0.5 * SPOOF_ACC * (t - SPOOF_START) ** 2 if t > SPOOF_START else 0.0
    residual = math.hypot(dr_err, offset)
    if residual > LIMIT:
        print(f"ALARM at t = {t} s: residual {residual:.2f} m, position already dragged {offset:.2f} m")
        break
    if t % 10 == 0:
        print(f"t = {t:>2} s: residual {residual:.2f} m (spoofed offset {offset:.2f} m)")

t =  0 s: residual 0.00 m (spoofed offset 0.00 m)
t = 10 s: residual 0.50 m (spoofed offset 0.00 m)
t = 20 s: residual 1.00 m (spoofed offset 0.00 m)
t = 30 s: residual 1.80 m (spoofed offset 1.00 m)
t = 40 s: residual 4.47 m (spoofed offset 4.00 m)
ALARM at t = 42 s: residual 5.28 m, position already dragged 4.84 m

Countermeasures

• Multiple constellations and frequencies make it harder to spoof or jam every signal at once.
• Navigation message authentication, such as Galileo OSNMA, whose Initial Service the European Commission declared on 24 July 2025, lets a receiver check that navigation data really comes from the system. It does not prevent jamming.
• Sensor consistency checks, as in Example 2, plus checks for impossible values such as speed beyond the drone’s performance.
• Antennas and mounting that reduce reception from near the horizon, the direction ground-based jammers transmit from.
• Procedures when GNSS is unusable, such as hovering or flying on another navigation source to a safe point, tested in SITL first.

Module lab

Common mistakes

Summary

• The GPS L1 C/A signal can be as weak as −128.5 dBm, so low-power jammers work over wide areas.
• J/S follows from transmit power, path loss and the wanted signal power.
• Gradual spoofing can capture a drone without triggering a failsafe.
• Comparing with DR and other sensors helps detection, but thresholds must come from real data.

Check your understanding

1. When distance increases from 500 m to 1,000 m, how many dB does free-space loss increase?
2. The jamming signal arrives at −90 dBm and the GPS signal at −128.5 dBm. What is J/S?
3. Why is gradual spoofing harder to detect than a jump?
4. What does OSNMA help with, and what does it not help with?
5. What are the pros and cons of lowering the residual threshold from 5 m to 2 m?