Leaders in the GNSS/PNT community are reacting to the Federal Communications Commission (FCC) decision to approve an order to allow Ligado Networks to deploy a low-power nationwide 5G network. The departments of Defense and Transportation have criticized the decision, concerned about interference with GPS signals.
Below are statements we have received from our readers.
Logan Scott, LS Consulting
Logan Scott
Spectrum regulation is much like land use zoning in that certain services are kept separate so as to avoid disturbing the neighbors. The FCC has in effect allowed Ligado to build an outdoor concert venue next to a monastery and by way of compensation, they offer free earplugs. GPS / GNSS signals are extremely weak and the receivers are extremely sensitive. To give some perspective, by the time they get to the GPS receiver, GPS signals are about a factor of 20 less powerful than cosmic background noise. Ligado’s spectrum is/was licensed for mobile satellite services (MSS) and so was not likely to interfere with GPS.
With their new, and much more valuable license, Ligado now has a legal right to build a terrestrial cellular service. Exhaustive testing over the last 10 years has repeatedly demonstrated that such a system will interfere with high precision GPS/GNSS receivers used in surveying, timing, and earth observation. The DoD has also made strong claims that such a system will cause harm to their systems. In all cases, the effect is much like riding a bicycle at night. You can see fine until someone comes around the corner with the high beams on and blinds you.
The FCC has in effect allowed Ligado to build an outdoor concert venue next to a monastery and by way of compensation, they offer free earplugs.
In their earlier filings, Ligado had asked for permission to transmit at a power level of 1500 Watts. In an amazing piece of legerdemain, they convinced the FCC, but not the DoT or DoD, that by reducing transmit powers to 10 Watts, there would be no harm. This is a stunningly erroneous claim. As you lower the transmit power, you need many more cellular basestations to cover a given area. To use an analogy from my backyard, I can install one high flow sprinkler head to cover the entire yard or a bunch of low flow heads, each covering a small portion. Either way, the grass doesn’t care about anything other than inches of water and I’m gonna get wet if I run across the yard. Ligado’s core argument is equally wet. Nonetheless, it has great appeal to people who don’t understand how cellular systems work.
So, moving forward and assuming the license stands, interference events will become more prevalent and GPS will be deemed “less reliable”. Because interference sources are largely untraceable, blame will rarely attach to Ligado. I expect that GNSS receiver vendors will incorporate improved filters into receivers and pass the cost along to buyers. Ligado, or more likely whoever they sell the spectrum to, will quickly move to petition for increase transmit powers so as to lower capital costs; after all more basestations cost more. And so, the Visogoths have arrived, 4G in hand with a 5G label.
John Fischer, Orolia
John Fisher. (Photo: Orolia)
At Orolia, we support the position of the DOT, DHS and DOD and the measures they are taking to protect the GNSS band. However, interference is a fact of life in this band as the GNSS signals are very weak, so additional measures must be taken for resiliency, especially for critical infrastructure. Adversarial interference is much worse than this, so a range of solutions are possible: from the simple – for example, a horizon blocking antenna that shields energy from a nearby tower – to full multi-layer defenses that include RF filtering, advanced DSP filtering/detection, alternative PNT from STL signals, atomic clock and IMU backup, and CRPA antennas. No one solution covers every case, but the problem can be managed.
Mitch Narins, Strategic Synergies
Mitch Narins
It is quite concerning when a panel of lawyers makes a decision, despite the results of years and years of studies, and over the objections of our nation’s technical and operational Position, Navigation and Timing (PNT) experts. While I have championed the need for a complementary and resilient PNT system for many, many years, one cannot dispute the worldwide benefits that GPS and other GNSS have brought — from safety, security, and economic perspectives.
As noted in the FCC’s press release, “The order also requires Ligado to protect adjacent band incumbents by reporting its base station locations and technical operating parameters to potentially affected government and industry stakeholders prior to commencing operations, continuously monitoring the transmit power of its base station sites, and complying with procedures and actions for responding to credible reports of interference, including rapid shutdown of operations where warranted.” I believe that it is imperative that GPS users, both within the Government and in the private sector, understand:
How base station location information will be disseminated, what power levels and radiation patterns will be utilized, and what recourse GPS users will have to object to the proposed location and service;
How the service will be monitored for each base station location, what systems will be used to do the monitoring, and how the monitoring information will be publicly disseminated;
How reports of interference will be filed, how and by whom they will be determined to be “credible”, how and in what timeframe will a “rapid shutdown of operations” be accomplished, and how appropriate mitigations will be identified and implemented; and
Given the importance and concern associated with this action, what special oversight mechanisms, involving civilian and military participants, should be put in place to avert potential safety, security, and economic impacts to our nation’s critical infrastructure.
While one can model, and even test problems based on the location of facilities where aircraft would be expected to be operating close to the ground (e.g., airports and heliports), one can never be sure where a medevac or other first responder helicopter may have to set down in response to an accident or incident site. In keeping with the FCC’s own press release, it is unclear how a pilot experiencing problems with GPS (if, in fact the pilot could recognize such a problem) would be able to report the issue and have it mitigated in real time to support a safety or security mission — unless all areas around all ground transmitters were mapped and first responders could request specific ones to be turned off when operations were expected in a known area. Unfortunately, the limits of these operating areas are, many times, unknown or rapidly changing (e.g., forest fires) and any delay in reaction to unforeseen events could prove detrimental to safety, security, and economic wellbeing.
Mitre conducted a test wherein small Unmanned Aerial Systems (sUAS) could detect and avoid an aircraft based on receipt of its ADS-B squits. Perhaps these ground transmitters should include ADS-B receivers and automatically go off-air if a helicopter comes within a certain distance. I have no doubt that Ligado would not appreciate this solution …
I would hope that those who disagree with this decision will seek out a means to correct this through either the legislative or judicial branches or both. Personally, I cannot see how this either “promotes the general welfare” or “provides for the common defense” (I didn’t have to go to law school to come to those conclusions). I also believe that (1) the ever growing importance and criticality of PNT services should provoke the Congress to modify the makeup of the FCC to include PNT expertise at the very top; and (2) the FCC Office of Chief Engineer needs to become an independent point of expertise akin to the Office of Inspector General to preclude undue pressure and potential political “bending” of technical analyses.
Finally, regardless of whether one agrees or disagrees with the FCC’s order, no one can possibly believe that this decade-long tale of woe is an example of governmental “best practice.” As it took the energy and significant resources from so many more important PNT initiatives, I hope that a quality/leadership body (perhaps GAO and/or a group of IGs) take up the task to do an independent “lessons learned” assessment of this decade-long tale of woe needs to be carefully examined, as it took the energy and significant resources from so many more important PNT initiatives — we should never have to go through this ever again.
Mitch Narins is the principal consultant and owner of Strategic Synergies, LLC, a technical and management consulting firm that he formed after retiring following over four decades of U.S. government service with the FCC, US Navy/Marine Corps, and the Federal Aviation Administration.
Alison Brown
Allison Brown
GPS user equipment needs to be designed to be more resilient to interference. The threat to GPS has been well understood for many years but agencies and vendors have been slow to respond to improve national resiliency against jamming threats. The President signed into law the National GPS Timing Resilience and Security Act in 2018 and on 2/12/2020 signed an Executive Order on Strengthening National Resilience through Responsible Use of Positioning, Navigation, and Timing Services recognizing “the disruption or manipulation of these services has the potential to adversely affect the national and economic security of the United States.” The onus is now on vendors and agencies to develop resilient solutions that can operate in the presence of intentional and unintentional interference. These solutions would also mitigate any potential impact from the use of adjacent bands by operators such as Ligado to deploy 5G and Internet of Things services.
Ellen Hall
Ellen Hall
Overall, the GPS industry should be encouraged to do more to protect themselves from harmful interference. While it is too late for today’s receivers, the next generation needs to introduce more resilience. I agree with the House Armed Services Committee Chairman in saying, “While I strongly support development of the world’s most robust, safe and secure network, using L-band spectrum in such close proximity to critical GPS, as Ligado’s proposal requires, carries an unacceptable risk….”
The FCC said the approval order included stringent conditions aimed at ensuring that GPS would be vulnerable to harmful interference. It seems the only way to prevent harmful interference, would be to permanently fund an oversight commission to monitor Ligado’s system. I believe only Congress can appropriate funding for this effort, therefore the FCC’s decision should be a recommendation to Congress to implement. It is not enough to leave it to a five-person committee to “encourage” that “stringent conditions” are implemented. Enforcement is crucial. Critical infrastructure should be regulated to ensure that we can cope better with “noisy neighbors.”
The U.S. Air Force will load a new signal feature, designed to make spoofing detectable, aboard a satellite that will broadcast it from space as a security overlay for the GPS L1C signal, but not until 2022 at the earliest.
The Chips Message Robust Authentication (Chimera) is now in testing under the auspices of the Air Force Research Laboratory (AFRL), getting ready to fly on the Navigation Technology Satellite 3 (NTS-3), which will trial a number of new PNT techniques and technologies.
Chimera inserts encrypted digital signatures and watermarks within the L1C signal. A GPS receiver with the requisite additional capability for this purpose can then detect whether the signal is real or fake and also authenticate the location of a GPS receiver that is remotely located.
This key feature could provide a defense against hacking by blocking access from anyone unable to prove they are at an anticipated or licensed site. Hacking, of course, is a growing threat to all sorts of infrastructure: financial, security, utility grid and more.
Presentation slide from PNT Advisory Board briefing by Logan Scott.
Consultant Logan Scott first proposed the Chimera technology in 2003, when he affirmed that “Some of the spoofing detection measures in wide use offer a false sense of security. Authenticatable signal architectures are needed.” In June, he made a presentation to the PNT Advisory Board: “The Role of Civil Signal Authentication in Trustable Systems.” The two slides accompanying this article appeared in that presentation.
“Chimera represents a fundamental paradigm shift in PVT security paradigms,” Scott related in a subsequent conversation. “Trust takes time and memory on a personal level and, in this case, in GNSS signals, too.
“You don’t trust somebody as soon as you meet them. Over a period of time, you get to know them. If you can’t remember anything, you can’t develop trust either.”
“In the GNSS world, there are a lot of applications where you don’t need output in real time,” Scott said. “For example, to align an inertial. The inertial provides the real-time aspect. You don’t want to send anything to the IMU that is factually incorrect. When building to aid inertial, I can afford to have a delay from real time as long as I tell it where it was 10 seconds ago. The power of that is, if I don’t have to give real-time output, I can ponder and think about things.
“If a spoofer attacks, there’s an evolution that happens there. If I, as the receiver, can see the developing scenario, and how it starts to look at little screwy, I can stop and not send anything to the IMU that might corrupt it.”
How It Works. The core concept of Chimera involves the satellites sending encrypted watermarks, encoded into the signal by the satellite. After a slight delay, the satellite sends the key used to generate those encrypted watermarks. Once a key is sent, the system changes the key.
Since the receiver has already recorded the signal with its watermarks before the key is sent, spoofers cannot know the correct key ahead of time, in time to insert correct watermarks of their own. This means that any spoofed signals can be easily spotted: either the subsequent key won’t match up with the spoofed watermarks, or there will be no watermarks at all.
“Another reason it’s hard for someone to generate these watermarks on their own is because the signal is buried below the noise,” added Scott. “The watermarks are hidden.”
A number of different time delays between signal and key are possible within this concept and within the general set-up of GPS. Scott and the AFRL have, for various practical reasons, provisionally settled on a 6-second delay on the fast watermark channel and a 3-minute delay for the slow watermark channel.
The signal enhancement could be incorporated into the Wide Area Augmentation System (WAAS). This has yet to be fully determined, but this route would lead to a faster implementation of Chimera. Scott thinks that going the WAAS route could bring Chimera capability into action within two years.
The AFRL, however, is looking at a much longer timeline. The NTS-3 satellite, where it first intends to test Chimera, will not launch until 2022 — three years hence. And that’s only a test, not an enactment or a system-wide implementation.
Slide: Logan Scott
Verification. One key benefit for commercial entities, particularly those in financial infrastructure and other systems that increasingly fall victim to hacking, is that Chimera gives them the ability to verify customers’ or partners’ locations before granting any kind of access. The customer’s or other erstwhile user’s GPS receiver would record the full signal, including the watermarks, and transmit that data to the company, entity or data center needing location verification, before the keys are published. Each combination of watermarks and signals is unique to the place where it was recorded, thus it is possible to tell whether the user is actually where they say they are, or in an authorized or pre-identified location before granting access or accepting further input (such as commands).
Scott claims that Chimera affords a 99.9% probability of detecting spoofers. “I have a 99.9% chance of detecting that the watermark is not there, because they don’t know how to generate it. This is based on how you’re processing the signal. It’s designed to be very flexible in how the receiver uses the signal.”
Just One Problem. Receiver manufacturers will have to develop new Chimera-capable receivers, and customers will have to buy them. An additional cost for the added processing, above and beyond that required for normal GPS operation, is unavoidable.
And a Hiccup. Chimera, while an acronym, is as a name perhaps not a totally felicitous choice. In Greek mythology, the chimera is a fire-breathing female monster with a lion’s head, a goat’s body, and a serpent’s tail. These historic ancestors have evolved into the word’s more current use: a thing that is hoped or wished for but that is in fact illusory or impossible to achieve.
AFRL Wants Your Opinion. The Air Force Research Laboratory seeks feedback from the PNT community on the Chimera enhancement for the L1C signal. The specification is here. And, you can download a comment form
Logan Scott, principal, LS Consulting. (Photo: Melanie Beus)
Logan Scott, principal at LS Consulting, is the inventor of an asymmetric navigation security paradigm for civil GPS signals that avoids the need for secure key storage in civil receivers and allows for widespread adoption in applications without physical security capabilities. Scott received the 2018 Signals Leadership Award from GPS World magazine. Read his acceptance speech below.
A crucial first step in developing resilient responses is to recognize that there is a problem so you can isolate it. Otherwise, an overly trusted element can contaminate the solution.
I am honored to accept this award from GPS World and our sponsors tonight. It has been a long journey from my initial vision of how civil signals might be authenticated to where we are now, with a draft Chimera signal specification nearing readiness for review.
I’d like to thank the Air Force Research Laboratory for sponsoring these efforts, and I would also like to acknowledge the outstanding efforts of the entire signals working group without whom this milestone would not have been reached: Captain Katie Carroll, Jon Anderson, Joanna Hinks and Nate DeVilbiss who brought me in on the project; Joe Rushanan and Jim Gillis who taught me so much about cryptography; Renee Yazdi and Brady O’Hanlon who pushed for no compromises. Working with this team has been one of the highlights of my professional career.
We have a solid design that fully realizes the benefits of chip-level binding with both fast and slow authentication capabilities. Chimera can offer security benefits far beyond the security theater of data message signing only. Moreover, it is a first step towards proving location.
Moving forward, the challenge I offer to you all is this: how can we establish the integrity and truthfulness of position and time reports both locally and remotely? How can we prove location, not only to ourselves but also to remotely located entities? In a world of autonomous vehicles, geofenced capabilities and information access, and an insecure supply chain, it is not enough to say that “I saw it on the C/A code.”
Complementary and overlapping techniques are essential in establishing the veracity of any claims. In support of this, we can and must provide assured spectrum protections for all GNSS systems.
Logan Scott of LS Consulting received the 2018 Signals Award. Joe Rolli from Harris Corporation was on hand during the GPS World Leadership Dinner and Awards ceremony to present the award.
At the GPS World Leadership Dinner and Awards Ceremony in Miami on Sept. 27, 120 VIPs from the international GNSS/PNT community gathered to honor recent significant achievements in four fields: Satellites, Signals, Services and Products.
The honorees, so voted by a panel of their peers, appear below. Also, see our article here.
Their remarks upon receiving the awards will appear in the December issue, along with Future Visions for 2019 by the executive officers of GPS, GLONASS, Galileo and BeiDou.
Rounding out the evening after speeches, dinner and good conversation among good friends, old and new, was the Smart City Jam! We attempted to replicate, on the carpet of the 14th-floor banquet room, an obstructed urban environment, replete with malicious jammers. And we challenged all comers to “autonomously” navigate to a goal in this hostile environment with remote-controlled rock-crawlers. Details on this as well coming up in December.
Four innovators in the fields of satellites, signals, services and products accepted Leadership Awards for 2018 from this magazine at the GPS World Leadership Awards Ceremony and Dinner on Sept. 27 in Miami. Their remarks at the podium directed the audience of PNT industry and research community VIPs to key challenges for the future.
Satellites
Javier Benedicto, left, accepts the Satellites Leadership Award on behalf of Giuliano Gatti of the European Space Agency, from Phil Froom of Rockwell Collins. (Photo: Melanie Beus)
Kicking off the ceremony, Phil Froom of Rockwell Collins mentioned that “Rockwell Collins and QinetiQ [have] signed an alliance agreement to produce a new family of high-assurance, multi-constellation GNSS receivers for professional and military use. This new family of receivers is aimed to be complementary to the current encrypted family of Rockwell Collins receivers in service across the globe, but allow the customer to select the level of capability and protection based upon operational, political or even financial needs.”
(Photo: Melanie Beus)
Froom conferred the Satellites Award upon Giuliano Gatti of European Space Agency, for his contribution to setting up the Galileo constellation, as Space Segment Procurement Manager, from GIOVE-A through all current operational satellites, a total of 26 deployed in 7 years.
Accepting the Award on Gatti’s behalf, Javier Benedicto of ESA told the crowd about “two moments in his [Gatti’s] professional life that were very beautiful and very difficult. The beautiful moment was January 12, 2006, when the very first Galileo satellite, GIOVE-A, started transmitting the first Galileo signals. The most difficult moment was on August 27, 2014, when we saw that Soyuz rocket deploy our satellites a few thousand kilometers before the intended orbit. We thought, how are we going to recover? Today, the satellites are working, and they will be injected into the constellation in a few months.”
[The full text of remarks by both award conferrers — Leadership Dinner sponsors Rockwell Collins, Harris and Spirent Federal — and award recipients will appear in the December issue of the magazine. Jointly with their remarks directing all in the PNT community to future challenges will appear the Directions 2019 special section: essays by the chief executive officers operating the GPS, GLONASS, Galileo and BeiDou constellations. Look for it!]
Signals
Joe Rolli, Harris Corporation. (Photo: Melanie Beus)
Joe Rolli from Harris opened by saying “I work with an amazing group in Clifton [New Jersey] that comes together, overcomes challenges, builds our [GPS III] payloads, and provides a system that everyone uses every day. I think we’ve gotten to the point where we can honestly say, almost nothing works without GPS.”
“The challenge that I see [for the future] is to overcome the politics: where do you draw the line between doing what’s right for the PNT solution for the common good and addressing your national security and your own agendas in protecting your own country.”
After further comments, he called Logan Scott of LS Consultiing to the podium to receive the 2018 Signals award. Scott has been, in the words of the person who nominated him for the award, “an advocate for improved civil GPS security, and the inventor of a new asymmetric navigation security paradigm for civil GPS signals that avoids the need for secure key storage in civil GPS receivers and thus allows for widespread adoption in applications without physical security capabilities.”
Logan Scott, LS Consulting. (Photo: Melanie Beus)
Scott spoke about the Chips-Message Robust Authentication (Chimera) for GPS Civilian Signals project, in which he was a key participant. “Chimera can offer security benefits far beyond what you see with data message-signing only.”
“Moving forward, the challenge I offer to you all is this: how can we establish the integrity and truthfulness of position and time reports both locally and remotely to other people and mechanized devices? In a world of autonomous vehicles, crowd-sourced databases and geofenced capabilities and information access, and an insecure supply chain, it is not enough to say, ‘Well, I saw it on C/A code.’ ”
Services
This award, sponsored by Spirent Federal, brought Justin Eldredge to the microphone.
Justin Eldredge, Spirent Federal (Photo: Melanie Beus).
“This year we maintain our position of being first to market with new signals, with the launch of SimMNSA. We’re currently in the final test phase of this new M-code option and it will delivering to several authorized customers by the end of the year. If M-code signals aren’t in the spectrum of testing for you, we offer products that simulate all other GNSS signals, plus a variety of other sensors.”
Eldredge introduced John Raquet, professor at the Air Force Institute of Technology. Raquet was nominated and subsequently voted as winner of the Services award for work he and his team at the Autonomy & Navigation Technology (ANT) Center developed on PNT sensors and systems utilizing almost every available source, including GPS, GNSS, inertial, vision, lidar, magnetic field, pseudolites, radar, terrain mapping, signals of opportunity, star trackers, radio ranging, 3D audio, X-ray pulsars, clocks, and more.
John Raquet, U.S. Air Force Institute of Technology (Photo: Melanie Beus).
“Sometimes I called the ANT the Crazy Idea Factory. We’ve tried lots and lots of things,” said Raquet. “I think I have the best job in the world, because I get to experiment with many, many things, and work with amazing people.”
“This is not the kind of community where you build something once and you’re done, you put it away. This is a growing worldwide enterprise that takes new talent to come in and fill the spots that many of the people in this room have occupied. I’m privileged to see some of the students that we’ve worked with to then go on and fill some of the gaps, really do some amazing things.”
Products
Jade Morton, who herself received a Leadership Award in 2015, introduced the final honor of the evening.
“There’s a community of people kind of like you guys, a few of them are sitting here, who are crazy about the atmosphere. That’s their livelihood. They’re talking about how to use satellite navigation technology to monitor the atmosphere, to provide forecasting and modeling technologies. All of these effects, we [navigation engineers] have done everything we can to filter them out, to make them go away. But this company built a system to analyze the real traits that the atmosphere has imprinted on GNSS signals.”
Jean-Marie Sleewaegen from Septentrio then accepted the Products award, jointly on behalf of his colleagues Tom Willems, Andrew Simsky and Wim de Wilde. The company’s PolaRx5S receiver supports worldwide ionosphere monitoring, providing multi-frequency multi-GNSS measurements with low phase noise, high data rates, and flexible configurations, and enabling many Earth-observing applications ranging from ionospheric scintillation characterization to tectonic movements monitoring.
Wim de Wilde and Jean-Marie Sleewaegen, Septentrio, and Jade Morton, University of Colorado (Photo: Melanie Beus).
Sleewaegen said, “We continue to cherish our close ties with the research community. While most of us dream of getting rid of these error sources and these perturbations, atmospheric research scientists don’t want us to filter them out — they want to focus on them and see them in their full glory! The technology that we developed [to both mitigate and preserve the perturbations] is now at the heart of all of our receivers.”
“With the avalanche of new signals and constellations that we see — in some regions of Asia you can now see more than 60 GNSS satellites — the question is how to absorb, process and use that huge amount of data. All these questions are still not answered and will definitely keep us busy for years to come.”
The GPS World Dinner and Awards Ceremony are held annually at the time of (although separately from and independent of) the ION GNSS+ conference. Nominations for the awards come from a group of 40 industry executives and researchers. A ballot of the nominees is then circulated to a larger group of similar make-up.
The festive evening concluded, after dinner and dessert, with the Smart City Jam!, a group exercise in navigation and obstruction. Details in the December issue.
At the Smart City starting line (Photo: Melanie Beus).Smart City jammers in action (Photo: Melanie Beus).And they’re off! (Photo: Melanie Beus)
Last gasp, struggling to finish in second place (Photo: Melanie Beus).You wouldn’t think that professional navigation engineers would be so enthusiastic about jamming (Photo: Melanie Beus).
Somehow, the team of Leadership Award winners (LOQUATRIO) ended up winners of the Smart City Jam! as well. Smart drivers (or jammers) (or both). (Photo: Melanie Beus).
Threat Development Parallels Information/Communication Technology
Headshot: Oscar Pozzobon
By Oscar Pozzobon
The GNSS interference session this year at the ION-GNSS conference in Nashville was one of the most crowded, confirming the need of all sectors of the community to understand the threats in GNSS and how they can be mitigated. In that context I received one of the most challenging questions of my career: “Can we predict the future of GNSS security?” What is the status of civil and commercial GNSS security today? Which are the threats and risks and how they are mitigated? Where are we going and what shall we expect from the future?
I decided to tackle this topic carefully, using as a basis and inspiration the history of information and communication technology (ICT) security: from the first threats and attacks of the 1980s to a glance at what technology offers today.
Secondly, to obtain different perspectives — and shift the blame to someone else if one day these predictions should prove to be wrong — I solicited the opinions of three other experts and colleagues in the domain of GNSS and security: Logan Scott, Todd Humphreys, and David Last.
Snapshots from History
The Internet was officially born in 1969 when the U.S. Defense Advanced Research Projects Agency (DARPA) crated the Advanced Research Projects Agency Network (ARPANET). A short 11 years later, the 414 Gang, a computer-hacking organization (the term hacking was coined at the Massachusetts Institute of Technology as early as the 1960s) performed one of the first attacks and frauds upon computer systems. In 1983 the first computer virus was discovered. In 1988 the Computer Emergency Response Team (CERT) was created to report and disseminate information on the threats, and AT&T Bell Labs created the first concept of firewalls. Some readers may recall the 1983 movie War Games, which found Hollywood hard at work on cyber-attacks, denial, and deception to computer systems at a time when we had only six GPS satellites in orbit. One year later, Steven M. Bellovin published a paper on the possibility of performing a transmission control protocol/internet protocol (TCP/IP) Spoofing attack.
Six years after that paper, in 1995, the Computer Incident Advisory Committee (CIAC) reported the first TCP/IP spoofing attack to a system. In another four years, the first denial of service (DoS) attack to computer networks was reported by the CERT. A DoS attack consists of several computer systems sending unsolicited requests to the target, causing a saturation of network and computer resources. In terms of objectives, it could be compared to what jamming causes in GNSS systems.
Between 1984 and 1986, Dorothy Denning and Peter Neumann researched and developed the first model of a real-time intrusion detection system (IDS). This prototype was initially a rule-based expert system trained to detect known malicious activity. I like to think that this could be compared to today’s jamming detection and localization systems.
In the 1990s, the need for guidelines to provide general outlines as well as specific techniques for implementing security became a pressing one for all organizations. The first standard, originally published by the British Standards Institution (BSI) in 1995 was the BS 7799, was later adopted by the International Organization for Standardization (ISO) as the ISO/International Electrotechnical Commission (IEC) 27000 series.
Information technology today can be security-evaluated via the Common Criteria (CC) standard (ISO/IEC 15408), which allows computer-systems certification. CC is a framework in which computer system users can specify their security functional and assurance requirements. The Federal Information Processing Standard (FIPS) 140 is an alternative standard for cryptographic modules, developed by the U.S. Federal Information Processing Standards.
The Nessus Project, started by Renaud Deraison in 1998, set as its objective the provision of an open-source vulnerability-assessment tool. Since 2000, Nessus has become one of most popular tools for computer-network security and vulnerability assessment, used by more than 75,000 organizations worldwide.
ICT security today is assured in a lifecycle composed by CERT managing the threats notifications, ISO/IEC 27000 managing the processes, and CC/FIPS 140 defining the security requirements for the system and vulnerability assessment tools to certify the robustness.
Now, Where Are We in GNSS?
Radio-frequency interferences (RFI) or jamming cases can hardly be tracked, as they are difficult to detect and have a long history in the military domain. Recent incidents such the one at Newark International Airport show that the threat is increasing and demonstrate the need for mitigation strategies. GNSS signal falsification frauds, or spoofing, seems to as yet have no evident cases in the civil domain.
The Volpe Report of September 10, 2001 is one of the first government public announcements of GNSS threats, including jamming and spoofing. More than 10 years, later the unmanned aerial vehicle (UAV) experiment coordinated by Todd Humphreys at the University of Texas proved that such attacks are feasible.
In GNSS, jamming detection (and sometime mitigation) are nowadays commercial options for some professional and mass-market GNSS receivers. Spoofing detection has been available in commercial prototype receivers since 2008 (among others, the Trusted GNSS Receiver (TIGER) funded by the European GNSS Agency. In 2012 we have seen the presentation of the first civil GNSS security testbed. For examples of the latter, see the University of Texas TEXBAT initiative, mentioned on page 37, and the GNSS Authentication and User Protection System Simulator (GAUPSS) project, which involved the development of software and algorithms that were integrated and tested in the radio navigation laboratory of the European Space Agency/ European Space Research and Technology Centre (ESA/ESTEC) in Noordwijk, the Netherlands.
I will make the assertion that compared to ICT security, civil GNSS security seems to be reliving the early days of the 1980s: first publication of attack concepts, first publicly known attacks, no standards, and only prototype mitigation strategies. With a gap of almost 30 years, at least four mid-Earth orbit GNSS systems becoming operational in the next few years, and an annual 10 percent growth rate of GNSS applications, the era of civil GNSS security begins now.
The Question Why
Logan Scott is a consultant specializing in radio-frequency signal processing and waveform design for communications, navigation, radar, and emitter location. His opinion on the future threat leaves no doubts:
“In assessing security threats, an important starting question is ‘Why would someone do that?’ If there is no motivation, chances are, there won’t be an attack. Over the last five years or so, the combination of ubiquitous, low-cost communications systems and satellite navigation has moved civil GNSS positioning and timing into use domains where there are stronger motivations for an attack. Specifically, widespread use in asset monitoring and tracking encourages jamming attacks and so, we are seeing more such attack. As GNSS becomes more deeply embedded into societal infrastructure, we can expect to see more attacks of increasing sophistication. Motivation will be there.”
David Last is a consultant engineer and expert witness specializing in radio-navigation and communications systems. He operates in the domain of covert tracking and law enforcement,, an area where interference can be tempting. As expert in the field, and to the best of his knowledge, he believes that “although there are some cases of jamming, we have seen no events of spoofing — so far. To date, all we have seen from criminals are crude jamming attacks. Attacks by technically sophisticated aggressors who understand GNSS vulnerability have yet to start. They will be much more serious.
“Furthermore, when the receiver stops receiving data in a court case, we can’t say it’s jamming: we can mention that is one of the things that stops the signal. Law enforcement is now beginning to use receivers that can perform jamming detection.”
David Last’s opinion on the issue of potential low-cost spoofers appearing in the near future was also provocative: “Criminals don’t buy things, they steal them.”
The Time is Right, Now
An ICT security standard arrived about 10 years after the first publication and case reports of attacks. Are we at the right time, now, to consider security certification of GNSS receivers?
Logan Scott’s opinion is that receivers should be certified in order to provide awareness of the attacks:
“Today, essentially all houses and buildings have smoke alarms. Smoke alarms don’t put out fires but they do alert the occupants to the probability that there is a problem. Similarly, GNSS receiver situation awareness regarding jamming and spoofing is a first step towards militating against attacks on GNSS components. As civil receivers stand today, many don’t discriminate between loss of lock due to signal attenuation and loss of lock due to jamming. This needs to change.
“Fairly simple algorithms can detect most types of jamming and spoofing. Jammers and simple spoofers almost invariably affect automatic gain control gain settings. They are easy to detect. More sophisticated spoofers have difficulty covering apparent direction of arrival and can be detected using some simple antenna techniques.
“The problem for the user community at large is in knowing whether or not a receiver maintains adequate situational awareness. This is where test-based receiver certification can play a role.”
Awareness is indeed needed to notify to the application the security and authentication state. GNSS authentication integrated in the system still lies far off.
Not only is implementing authentication without compromising user cost and simplicity challenging, but the impact on the ground and space segment in GNSS to maintain legacy signals compatibility is also considerable.
We believe that user-based authentication will be the Plan B for the next 5–10 years. This requires the development of receiver techniques and the use of security testbeds as the baseline for vulnerability assessment, in the same way the Nessus tool was used in the 1990s for computer network assessment.
On the test approach, Logan Scott stresses that “Using a series of canned scenarios, GNSS receivers can be tested to determine how well they maintain situational awareness. Do well enough, and the receiver can be stamped as certified, much like an Underwriters Laboratory (UL) label. The test process can be automated and conducted by an independent third party, similar to the way cellular equipment is certified.
“Additional certifications might include cyber security aspects such as accepting only digitally-signed software updates and maps, providing attestation capabilities, and use of authenticatable GNSS signals.
“The benefit for the non-expert user community is that they have a basis for selecting GNSS receivers, secure in the knowledge that they meet minimum performance standards.”
Testing, Testing
Ringing in my third fellow expert, I asked Todd Humphreys, assistant professor in the Department of Aerospace Engineering at the University of Texas at Austin, for his opinion regarding the future of GNSS security testing.
“A testbed capable of simulating realistic spoofing attacks is needed so that the efficacy of proposed civil GPS signal authentication techniques can be experimentally evaluated. A generic testbed capable of evaluating all known authentication techniques would be prohibitively expensive; for example, it would require a large anechoic chamber for evaluating receiver-autonomous antenna-oriented techniques. But if the scope of evaluation is limited to receiver-autonomous signal-processing-oriented techniques and networked techniques, then it is possible not only to develop an inexpensive testbed but to share the testbed’s data component so that the tests can be replicated in laboratories across the globe.
“In October, we released the Texas Spoofing Test Battery (TEXBAT), a set of six high-fidelity digital recordings of live static and dynamic GPS L1 C/A spoofing tests conducted by the Radionavigation Laboratory of the University of Texas at Austin. National Instruments is hosting TEXBAT on cloud servers so that anyone can download it.
“The battery can be considered the data component of an evolving standard meant to define the notion of spoof resistance for civil GPS receivers. According to this standard, successful detection of or imperviousness to all spoofing attacks in TEXBAT, or a future version thereof, could be considered sufficient to certify a civil GPS receiver as spoof-resistant.
“This is a spoofing-specific version of the ‘not stupid’ certification that Logan Scott has suggested for GNSS receivers. In my July congressional testimony, I advocated requiring a ‘spoof resistance’ certification for GNSS devices that are used in critical infrastructure.”
Looking into the Future
Now I turn and attempt to answer the final question: Can we predict the future of civil GNSS security?
I believe that we can predict that, unfortunately, attacks will increase, and new attacks will be discovered. For example, we have been talking about deception jammers (also known as intelligent, PRN, or gold code jammers) only in the last few years, as an emerging threat. We will see certification and standards for security in GNSS, and we expect them to come in the next five years. Tools for GNSS security testing are already available commercially, for example the Qascom GNSS Security testbed (GST). As ICT has CERT for notification of threat, we will also see the raising of a GNSS emergency response team — possibly called a GERT.
In conclusion, whether my predictions turn out to be correct or not, the good news is that GNSS security also has a history in Hollywood’s annals: the 1997 James Bond movie Tomorrow Never Dies narrates a spoofing attack on the GPS navigation system of a submarine, performed via a GPS encoder that modifies the time.
Again, 007 anticipated the future, and he did it 15 years before a handful of world renowned GNSS security experts.
I have not yet seen the 2012 James Bond film Skyfall. I wonder what it portends?
Oscar Pozzobon is the director and co-founder of Qascom S.r.l., based in Bassano del Grappa, Italy. He received a Masters degree in telecommunication engineering from the University of Queensland, Australia, and is the Italian contact for the Civil Global Positioning System Service Interface Committee (CGSIC).
‘We have virtually no defense against the cyber attacks that are targeting us now, and will be in the future.”
Richard Clarke served three U.S. presidents as counter-terrorism czar. He wrote a fascinating — and terrorizing — article in the April issue of Smithsonian magazine, from which comes that quote. I posted it on my LinkedIn page and asked for input for this editorial.
RF and signal-processing consultant Logan Scott, also an occasional author in these pages, sent in the following. I love it when people do my work for me.
Scott writes that “Richard Clarke says about cyber-defense: ‘I think we’re living in the world of non-response. Where you know that there’s a problem, but you don’t do anything about it . . . . That’s denial.’
“This certainly looks to be the case for GNSS. Looking into the future, if we continue our current civil GPS security policies, I think ‘woulda, coulda, shoulda’ will someday nicely summarize our feelings. GPS-derived time plays key roles in high-speed trading (~70% of all market transactions). GPS timing already synchronizes power-generation facilities, albeit not in the U.S. GPS-derived location plays a foundational role in air traffic control worldwide. Shipping containers and their cargo are routinely secured using GPS-derived location monitoring and geofencing.
“So how do we secure civil GPS? Mostly, we don’t. Simple situation awareness regarding jamming and spoofing is not present in most GPS receivers. Instead, we plan on having the cavalry ride to the rescue should some problem occur. This will work about as well as it did for Custer at Little Bighorn. The battle will be over before the response is mounted; our response will be mainly forensic in nature. Basic, test-based performance standards are needed so non-expert users can select adequate receivers.
“Even more fundamentally, we do not have the capability to authenticate and prove location to second parties. This could play a huge role in improving cybersecurity where one of the central problems is attribution. Knowing where the attack came from, we can add a layer to our defenses. ICS/SCADA commands from unauthorized locations could be rejected. Techniques for creating authenticatable location signatures are available, but due to funding shortsightedness, we continue to launch generation after generation of GPS satellite without these features. Supply-chain integrity could also be improved: in the future, parts could be stamped with their location and time of manufacture.
“We still have the opportunity to change ‘woulda, coulda, shoulda’ to a more favorable ‘Veni, vidi, vici’ — but the window of opportunity is closing.”
Letter to the Editor
In your March editorial, “The Fire Next Time,” you ask for suggestions to protect against another LightSquared encroachment. The solution is remarkably simple. Just let the same bandwidth be used for space downlink as it was originally intended. That would be both innocuous to GPS receivers and, more importantly, stake the ground against future challenges like LightSquared.
Disaster-preparedness plans recognize the individual’s role in his or her own survival. When storms approach, have water, food, and basic survival gear on hand. It takes time for help to arrive.
The civil GPS industry faces an oncoming storm of interference, and the receiver is the first line of defense. As we integrate GPS into all facets of our lives and infrastructure, we become more subject to disruptions, both unintentional and intentional. Newark International Airport now sees several jamming events per day. In Taiwan, one airport experiences an average of 117 events per day!
How can civil PNT infrastructure be made more resilient?
Faced with jamming, spoofing, and cyber attacks, receivers must take basic precautionary measures. They must recognize jamming and spoofing attacks to avoid generating hazardously misleading outputs. Situational awareness is key. Accurate and specific alarms must be generated so users can take action and authorities can be notified. Regular threat-signature updates can improve situational awareness, much like antivirus updates on a computer. Fire alarms don’t put out fires but they do save lives and improve response time.
Twenty years ago, computers rarely had firewall or antivirus protection. As GPS becomes more deeply integrated into communications-enabled systems, its utility increases exponentially but so does its vulnerability to cyber attack. When you update your GPS software or your maps, how do you know they have not been compromised? How do you know your receiver is authentic?
Figure 1. There are demonstrated, well known attacks that can cause receivers to output misleading information without warning. Many of these attacks can be detected using simple methods. Some receivers incorporate detection and countermeasures techniques. Many don’t. Receiver certification provides GPS buyers with a starting point for selecting GPS receivers. Certified receivers can accurately report on interference so it can be located and stopped.
The U.S. Navy recently discovered counterfeit routers in several of their installations. Well-developed computer security methods such as the Trusted Platform Module found in more than 300 million computers can help secure GPS receivers without impeding innovation.
The government can also play a role in improving receivers by providing an authenticatable civil signal structure. Well-documented Public Key Infrastructure methods such as digital signing and occasional, short-spread spectrum security-code bursts can be added to the new L1C signal. Receivers voluntarily using these signal features can establish signal provenance with extremely high confidence.
The public, unclassified keys needed to process these features could be sold and used as a revenue source for the GPS system. Receivers that choose not to use these features can ignore them without adverse impact other than weaker security. The large numbers of in-theater military users who rely on civil signals would also stand to benefit.
Finally, I would note that situationally aware receivers can provide specific and detailed reports about what they see. Interference-monitoring systems such as Patriot Watch will need detailed reports to sort and associate the multitude of reports they receive into a coherent picture of what is actually happening. To provide adequate geographic coverage, interference monitoring systems will need to accept reports from diverse receiver types on an opportunistic basis. In short, they will have to rely on crowdsourcing as a major operational input.
As Brad Parkinson noted during my presentation of this material to the November 9 meeting of the National PNT Executive Committee Advisory Board (“Receiver Certification: Making the GNSS Environment Hostile to Jammers and Spoofers,” at www.pnt.gov/advisory/2011/11/), in the early days of electricity, a lot of houses burned down because of electrical problems. Underwriters Laboratories helped immensely by testing electrical equipment to make sure it was reasonably safe, and consumers looked for the UL label. A voluntary, basic receiver certification process similar to Underwriters Laboratories should be pursued to provide the user community with a basis for selecting receivers.
Logan Scott has more than 32 years of military and civil GPS systems engineering experience. At Texas Instruments, he pioneered approaches for building high-performance, jamming-resistant digital receivers. While at Omnipoint, a cellular carrier, he developed cross-system interference mitigation strategies. He holds 33 U.S. patents.
Inexpensive, readily available GPS jammers constitute a threat to safety, national infrastructure, and industry revenue streams. Cell phones could incorporate GPS jam-to-noise (J/N) ratio detectors to provide timely interference detection and effective localization, with a flexible and updateable system since the crowd processing function resides in software.
Events in early 2010 at Newark Liberty International Airport demonstrate the vulnerability of civil GPS infrastructure to interference. Over a period of several weeks, sporadic outages of the GPS Ground Based Augmentation System (GBAS) located at the airport to provide precision approach services occurred, due to radio-frequency (RF) interference from unknown sources. Analysis showed that certain vehicles on a nearby freeway were the likely culprit(s), and an interdiction effort was launched to catch an offender. Using advanced interference detection equipment and multiple surveillance cameras, an offender — a truck driver — was caught and arrested. In his possession: a widely available $33 GPS jammer.
For sale over the Internet, the jammer emits 200 mW and plugs directly into a vehicle’s cigarette lighter (see photo). To prevent future incidents, the FAA is relocating the airport’s GBAS system to a more protected location away from the freeway.
Such an approach to jammer detection, localization, and enforcement, while successful in this instance, ultimately serves only as a stopgap. It took tremendous resources and several weeks to find one offender.
Increasing use of GPS jamming and spoofing to cover both licit and illicit activities is likely, given the general public’s desire for privacy and the general lack of awareness of how devastating GPS jamming can be. The $33 jammer in this instance could have affected critical flight operations 10 miles away. Currently, most jammers are not even detected; we simply have an unidentified GPS outage. It was only because of the technical sophistication of the FAA’s GBAS that the outage’s underlying cause was identified as jamming.
GPS Jammer. A $33, 200mW jammer for sale over the Internet.
At the ION-GNSS 2010 plenary session, Phil Ward advanced the notion that cell phones could incorporate GPS jam-to-noise (J/N) ratio detectors to provide timely interference detection. Having an extensive background in cellular communications as well as GPS, I found the idea intriguing. In this article, I explore the viability of this concept, whether jammer location can be determined, and what it would take to implement such a system.
In urban and suburban areas, it appears feasible to provide warning of jamming in less than 10 seconds while providing real-time jammer location to better than 40 meters. Such a capability would aid immensely in mitigating jamming events by enabling effective law-enforcement action. Potential jammers will know they are likely to be caught and that the penalties are severe. They won’t do it after a few well publicized interdictions. The cost for this nationwide system can be relatively modest. It won’t take billions of dollars and decades to implement; it will take an act of national will similar to the phase II wireless E911 effort. IOC could happen as early as 2015, with full national coverage by 2017.
J911 System Architecture
Figure 1 depicts the automatic gain control (AGC, the process by which RF front-end gain is controlled so as to present the analog-to-digital (A/D) converter with appropriate signal levels) loop found in some form in virtually all GPS receivers. The core objective is to set the gain GA so a set percentage of 2-bit A/D converter outputs correspond to large values of 3 and -3. Typically, VT percentage is set to 35 percent in a Gaussian noise environment to hold A/D conversion losses to ~0.5 dB. In another popular variation, the 1.5 bit A/D converter, the zero threshold is not implemented and three possible values are output (-1, 0, and -1). Such a converter has about 0.9 dB of conversion loss if VT percentage is set to 40 percent, and considerably simplifies correlator processing.
Figure 1. Adaptive A/D converter with jamming-to-noise (J/N) meter output. Knowing you are jammed is the first step.
Figure 2. J/N as a function of position relative to a 200 mW jammer. phones located closer to the jamming source will see higher J/N than those further away.
Of particular interest for interference detection purposes, the control voltage to the AGC amplifier can also be used to measure jammer-to-noise power (J/N). Under unjammed onditions, the nominal input power to an L1 C/A receiver is about -110 dBm, most of this due to naturally occurring thermal and amplifier noise. The C/A code signal at -130 dBm is a factor of 100 weaker and does not influence AGC operation. If, however, interference starts rising above the thermal noise floor, the AGC will respond by decreasing gain GA so as to maintain the correct percentage in large outputs. Response times to a change in input power level are very fast, typically less than 1 millisecond, and so pulse jamming characteristics can be determined as well.
If the receiver knows the control characteristics of the AGC amplifier (β,α) then the receiver can determine the change in J/N given V1. Additionally, if the receiver knows the quiescent V1 associated with a thermal noise-only input, it can obtain J/N on an absolute scale. To obtain the quiescent value, the receiver can short the antenna on power-up as part of built-in test prior to operation. Alternatively, it can maintain and refine a historical value during normal operations, the caution being that spoofers and jammers may try to manipulate history-based values.
Even with relatively small jammers, front-end saturation can be a problem when the jammer is nearby. The thermal noise floor in a 1.7 MHz bandwidth is about -110 dBm, and so a J/N of 60 dB corresponds to jamming signal strength of -50 dBm. Accurate J/N measurements are possible at this level, but likely require adding a switchable input step attenuator in the down-conversion chain. Measuring J/N above this level gets problematic for a low-cost GPS front-end.
In a further refinement, receivers can include additional comparators set at -1.2 VB and + 1.2 VB. If a constant envelope (CE) jammer (CW, swept CW, or Gold code jammer types) is present, this threshold will be crossed 16 percent of the time given CE jamming, versus 32 percent of the time for Gaussian distributed jamming if VT percentage is set to 40 percent, as is typical for a 1.5 A/D converter. With the jammer type identified, the receiver can adapt V<su
b>T percentage if it is seeing CE jamming to obtain several dB of additional jamming resistance. The TI-420 L1 C/A receiver developed by my team at Texas Instruments in 1986 routinely outperformed P-code receivers against CE jammers using this technique. The takeaway from this discussion is that with very simple hardware, an L1 C/A receiver can measure J/N and also determine the approximate type of jamming that it sees: pulse, constant envelope, and Gaussian.
Can this information be used to detect and locate jammers? In Figure 2, a 200 mW jammer is located at the origin [0,0] and J/N (dB) is plotted as a function of relative location. Conceptually, phones located closer to the jamming source will see higher J/N than those further away. The aggregate of phones, each reporting J/N and own position, provides a basis for locating the jammer. Some phones may also report the type of jammer they are seeing. Information about phone type and its physical orientation would also be of use in interpreting and correcting raw J/N information with regards to antenna gain and accuracy.
Structurally, the J911 system would be very similar to the E911 system and would heavily leverage existing infrastructure and standards already in place. When a wireless E911 call is placed, the serving base-station(s) routes the call through a mobile switching center (MSC) where the call is identified as a 911 call. The MSC then connects the call to a local exchange carrier (LEC) who then connects the call to a public safety answering point (PSAP).
In the United States, 6,149 PSAPs are distributed around the country.Wireless E911 calls are connected to a specific PSAP usually based on the location of the caller as determined by the cellular carrier. Under Phase II requirements, E911 call takers receive both the caller’s wireless phone number and their location information. Currently, 95 percent of PSAPs have some Phase II E911 capability.
Using the E911 system as a basis, creating a federal J911 PSAP to process J/N measurements into jammer location estimates would not be all that problematic. Software upgrades to phones, base stations, MSCs, and so on, are routine and often include new or modified message provisions and capabilities. Adding a Jamming Report message type would use existing message transport and routing facilities already part of the infrastructure. The main infrastructure addition would be a facility to process jamming reports, either at the federal level or as an adjunct to existing PSAPs.
Adding a J/N measurement capability to phones is a straightforward hardware issue, but modifying extant phones is not feasible. Fortunately, cell phones typically have a two-year lifecycle before being replaced. Adding a jammer reporting capability can be accommodated through the normal replacement cycle.
J911 System Performance
Given the location and J/N measurements obtained by a crowd of randomly located cell phones, one approach to determining the jammer’s location is to perform a series of curve fits for a grid of hypothetical jammer locations and see which location provides the best fit. Figure 3 illustrates this process; for the moment, the cell phones (observers) are assumed to provide exact J/N and location measurements.
Here, a 200 mWatt jammer is located at xy = [0,0]. 1,000 cell phones are uniformly distributed over a surrounding 1-square-kilometer area. A hypothetical jammer location grid of points 5 meters apart is created over a span of ±150 meters in x and y. At each hypothetical point, the 250 highest non-saturated J/N reports are used in a least-squares curve fitting process that assumes jamming strength falls off as 1/Rα. (In the ground mobile environment, α is usually in the range of 2 to 4. α = 2 is consistent with a free space propagation model.)
Specifically, J/N (dB) is presumed to be a linear function of log10 (R) where R is the range from reported observer position to hypothetical jammer location. At each hypothetical jammer location point, the norm of the residuals is collected as a metric of how closely the jamming reports (J/N + location) matched the least squares curve fit. The smaller the norm of the residuals, the better the curve fit. This metric is plotted in Figure 3 and shows that the best fit is obtained at the true jammer location.
Figure 3. Location metric as a function position relative to true jammer position (no observer errors).
In practice, knowledge of cell-phone locations is imperfect, and for those phones near to the jammer, GPS will be unavailable. There are several alternatives for determining location. Cellular carriers use a plethora of location determination techniques based on round-trip timing between the cell phone and observing base stations. Another very good option is to use Wi-Fi-derived location based on visible access points (AP). Companies such as Skyhook and Google have commercialized this technology, and it is available now in most areas. Positioning accuracies of 30 meters are typical, absent GPS. Looking down the road a bit, many phones now have integral accelerometers and could in the future propagate position with good accuracy even when GPS is unavailable.
Another very important factor is that J/N observations are going to be highly variable.
Three major effects to consider:
Cell phone errors in measuring J/N due to quiescent V1 errors, imperfect AGC amplifier characterization, and uncompensated receive antenna gain directionality.
Variability in J/N due to large-scale shadowing due to buildings, hills, bridges, etc.
Variability in J/N due to small-scale multipath effects. Jamming signals may follow multiple paths to the cell phone and add up constructively or destructively. Moving the cell phone a few inches may yield a very different J/N.
To model these effects, a log normal model of J/N measurement deviation from ideal free-space propagation is used. In this model, free-space propagation represents median signal strength and σ log normal, expressed in dB, describes Gaussian random deviation from the median signal strength. Such models are widely used in predicting statistical cellular coverage and have a strong correlation with real-world observations.
Figure 4 shows a jammer location metric manifold computed using the same process as in Figure 3, except now with observer location errors of
σx = σy = 30 meters and σ log normal = 6dB. Basically this says that the cell phones have Wi-Fi-based locations, and that the measured J/N is within ±6 dB of the free space value 68 percent of the time, and, within ±12 dB of the free-space value 95 percent of the time. These are relatively modest performance goals for the cell phones.
Figure 4. Location metric as a function position relative to true jammer position (observer errors: 30 meter 1 /6 dB 1 J/N).
In this particular run, the hypothetical jammer position yielding smallest residual norm is at xyjammer = [10,45] meters. Even though the individual measurements are of poor quality, the crowd consensus yields a fairly accurate estimate of the jammer’s position.
Before continuing, a few words on crowd size and cell phone densities. Assuming a cellular penetration rate of 70 percent, Table 1 shows approximate cell-phone densities for select suburban and urban municipalities. No doubt there is considerable variation in cell phone densities even within a municipality, but as a rough order of magnitude, 1,000 cell phones per square kilometer is not an unreasonable number.
Table 1. Density of 1,000 phones/square kilometer Is common in urban areas.
Figure 5 shows statistics of jammer location accuracies, presuming a uniformly distributed cell phone density of 1,000 cell phones per square kilometer. Based on a simulation of 500 independent runs, this figure plots jammer location radial error statistics assuming 25, 100, 500, or 1,000 measurements are processed in the curve-fitting process where radial error is given by:
Processing the full crowd yields 14-meter or better radial errors in 50 percent of the trials and better than 27 meters in 90 percent of the trials. So why process less than the full set of measurements obtained by the cell phones? In practice, if all cell phones observing a jamming event were to report everything they see, the cellular infrastructure could be overwhelmed. To limit traffic surges and to limit false alarms, a jamming event is likely to be processed in two distinct phases; the detection phase and the locating phase.
Figure 5. Radial error statistics with 1,000 phones/sq km crowd density.
Jammer Detection
In the detection phase, cell phones would report relatively infrequently based on which page group they are in. In current practice, to minimize cell-phone power consumption while in standby, each cell phone belongs to a particular page group based on its supposedly unique International Mobile Equipment Identity or IMEI. (As a bit of trivia, most cell phones display their IMSE if you dial *#06#). In GSM there may be 50 distinct page groups. Depending on which page group the phone belongs to, the phone knows when to wake up to listen to the paging channel (PCH) and see if there is an incoming call for it. By limiting jammer reporting based on which page group the phone is a member of (or IMEI), the size of the initial traffic surge can be limited.
During the detection phase, the system will also need to determine the type of interference event being seen. A solar event may trigger large numbers of phones, but the flat J/N versus location response can be used to rule out a localized jamming event. A real jamming event will tend to have a geographic center with many high J/N values over a fairly restricted area. Also, if CE interference is reported as opposed to Gaussian interference, there is good confidence the event is human originated, and the source can be located.
Jammer Localization
If jamming is determined to be the cause of interference, then the system transitions to a jammer localization phase. Tentatively, the jammer location process would seem to be better served by using phones near the jammer, but not those phones with saturated J/N meters. The non-saturated phones provide good RSSI (received signal strength indicator) information that is correlatable with distance, and those cell phones closest to the jamming source (high J/N) tend to experience fewer propagation anomalies. To control traffic loads during a jamming event, the J911 PSAP may restrict which phones report by requesting that only phones seeing a J/N value of greater than J/Nmin report.
Returning to Figure 5, processing the full set of data yields better snapshot jammer location accuracy as opposed to results obtained using a trimmed subset. Processing the full crowd yields 14 meter or better radial errors in 50 percent of the trials and better than 27 meters in 90 percent of the trials. Relying on only the subset of the 250 strongest J/N values adversely affects jammer snapshot location accuracy; yielding 47 meter or better radial errors in 50 percent of the trials and better than 110 meters in 90 percent of the trials.
The upside is that the traffic generated on the cellular network is one quarter as much. Stated another way, for a given traffic handling capacity, we could update jammer location at four times the rate. Using page group membership, general location, or IMEI as an additional reporting criteria, we can sample different cell-phone populations at each snapshot interval.
If a Kalman filtering approach is used to track/smooth jammer location estimates, the reduced set of observations may ultimately yield better performance, especially considering that individual phones can move around considerably over time. Also, geographical centroiding using phones with saturated or very high J/N indications may be another viable jammer locating technique, and perhaps combining approaches would be good. If the jammer is determined to be in a vehicle, substantial accuracy improvements in location accuracy may also be obtained by limiting the hypothetical jammer location grid to include only roads based on map input. These are all open issues for further study.
Figure 6 repeats the analysis of figure 5 except now, cases of much reduced cell-phone density are considered. In all cases, the full set of data is reported and processed. Not surprisingly, with more observers, the jammer locating accuracy is better, but even with low cell-phone densities, the performance is not bad: 50 meters 50 percent of the time, and 100 meters 90 percent of the time with 100 phones per square kilometer. Jamming detection and location is feasible in modestly populated areas.
Figure 6. Radial error statistics with crowd densities of 50, 100, 250 and 1,000 phones per square kilometer
Figure 7 shows radial accuracy statistics for σlognormal = 4, 6, 8 and 10 dB. As expected, as J/N measurement reliability deteriorates due to increased propagation variability and/or cell phone measurement errors, the accuracy of jammer location estimates also deteriorates but not catastrophically so.
Figure 7. Radial error statistics with σlog_normal =[4,6, 8, 10] dB crowd densities of 1,000 phones per square kilometer.
Similarly, simulation runs with larger cell-phone location errors showed modest performance losses in jammer location accuracy. In aggregate, Figures 5 through 7 point towards crowd size and crowd selection algorithm, not the accuracies of individual measurements, as the main driving factors in jammer-location accuracy.
Putting J911 in Place
Initially, wireless operators had little enthusiasm for implementing wireless E911 as it introduced substantial hardware requirements for mobile station (MS) position reporting (a cell phone is an MS). Now, E911 provides the technical underpinning for numerous revenue streams, most notably the location-based services (LBS) industry. GPS jamming is a direct threat to this revenue stream.
As GPS becomes integrated with vehicle navigation systems and intelligent highway systems, cellular carriers will play an important role in provisioning needed communications facilities. GPS jamming is a direct threat to this future revenue stream.
Cellular signal jamming is also a threat to national infrastructure (and carrier revenue). The approaches described above are readily adaptable to detecting and locating cellular frequency band interference sources in a timely manner. By emphasizing the potential benefits of a J911 system to the cellular carriers, there is better potential for buy-in by industry.
Using the wireless E911 experience as a model, J911 could be made a reality using a three-step process:
Rulemaking. After validating the requirement, the FCC would issue a Notice of Proposed Rulemaking (NPRM) stating the system functional requirements. Industry would comment, and through an iterative process the J911 requirements regarding performance and mandated deployment schedules would be established. This process would take about two years.
Standards Setting. Well established wireless, LEC, and PSAP standard-setting bodies would create detailed standards for implementing J911. The bulk of the work would be done by collaborating representatives from industry. Standards would be issued for various system portions — for example, MS standards, BSS standards, and so on — to permit manufacturers to build interoperable equipment. The standards setting process would take one to two years.
Rollout. With the exception of the MS portions, J911 does not require hardware modifications to the cellular infrastructure. J911 would be implemented and deployed as part of the normal update and release cycle. Under the mandate, new mobile stations would have to meet the requirements of the FCC rulemaking and standards setting processes. Over a two-year period, mobiles would transition to J911 capable models and the J911 system would be in place.
Crowdsourcing
In the March 7, 1907, issue of Nature, Francis Galton reports on an experiment where, at a county fair, he had 787 people guess the dressed weight of a fatted ox, charging them six-penny a guess. Individual estimates varied wildly, as did the expertise of the guessers. However, the median estimate of the crowd was within 0.8 percent of the correct value.
Conclusions
Creating a national infrastructure for detecting and locating GPS and cellular jammers is needed. Such a capability would provide the underpinnings for rapid and effective enforcement actions. Crowdsourcing approaches using a multitude of opportunistic cell phone based observers appears a plausible solution providing timely and location specific alerts. Even though the individual measurements are of poor accuracy, the crowd consensus yields good accuracy. While this system would not reliably detect purpose-built precision power-controlled spoofers, it could detect coarser cell-phone apps-style spoofers that might, for example, be seen in road-use tax avoidance.
Numerous open issues remain. Jammer antenna gain patterns can adversely affect locating accuracy. To what extent can this be mitigated by mapping out antenna gain contours? How can multiple simultaneous jammers be resolved? Can map and propagation modeling based aiding algorithms improve jammer location accuracy?
Significant research is needed, but the proposed system is open for continual improvement, even after it is fielded, since the crowd processing function resides in software.
Logan Scott is a consultant specializing in radio frequency signal processing and waveform design for communications, navigation, radar, and emitter location. He has more than 32 years of military and civil GPS systems engineering experience. As a senior member of the technical staff at Texas Instruments, he pioneered approaches for building high-performance, jamming-resistant digital receivers. He is currently active in location-based encryption and authentication, high performance/low bias adaptive array technologies, and RFID applications. He teaches Navtech Seminars’ New Signals course and holds 32 U.S. patents.
