GPS World

Tag: GPS jamming

  • The System: Test Data Predicts Disastrous GPS Jamming by FCC-Authorized Broadcaster

    Representatives of the GPS industry presented to members of the Federal Communications Commission (FCC) laboratory evidence of interference with the GPS signal by a proposed new broadcaster on January 19 of this year. The meeting and subsequent filing did not dissuade FCC International Bureau Chief Mindel De La Torre from authorizing Lightquared to proceed with ancillary terrestrial component operations, installing up to 40,000 high-power transmitters close to the GPS frequency, across the United States.

    The document describing the testing states that the Lightsquared initiative “will have a severe impact on the GPS band” and “will create a disastrous interference problem for GPS receiver operation to the point where GPS receivers will cease to operate (complete loss of fix) when in the vicinity of these transmitters.”

    On January 26, the FCC waived its own rules and granted permission for the potential interferer to broadcast in the L Band 1 (1525 MHz–1559 MHz) from powerful land-based transmitters. This band lies adjacent to the band (1559–1610 MHz) where GPS and other GNSSs operate.

    The FCC called for further testing to be led by LightSquared and completed by June 15.

    Prior to the decision, representatives of the U.S. GPS Industry Council and GPS manufacturers Garmin and Trimble presented “Experimental Evidence of Wide Area GPS Jamming That Will Result from LightSquared’s Proposal to Convert Portions of L Band 1 to High Power Terrestrial Broadband,” to five members of the FCC’s Office of Engineering and Technology, including its chief, two members of the FCC International Bureau, one from the Public Safety and Homeland Security Bureau, and two from the Wireless Telecommunications Bureau.

    A full PDF of “Experimental Evidence of Wide Area GPS Jamming” is available.

    The document conveys results of testing on a common portable consumer automotive navigation device and on a common general aviation receiver. The consumer GPS device began to be jammed at a power level representing a distance of 3.6 miles (5.8 kilometers) from the simulated LightSquared transmitter. The consumer device lost a fix at 0.66 miles (1.1 kilometers) from the transmitter.

    The Federal Aviation Administration (FAA)-certified aviation receiver began to be jammed at a distance of 13.8 miles (22.1 kilometers) and experienced total loss of fix at 5.6 miles (9.0 kilometers) from the transmitter.

    During the laboratory testing, GPS signals were simulated by a Spirent GSS6560 GPS simulator, representing a constellation of 31 GPS satellites, the current configuration. LightSquared’s signal was simulated using a Rhode and Schwartz SMIQ-03S signal generator with digital modulation, amplified to achieve the relevant signal strengths. Full technical specifications and parameters are described in the Experimental Evidence document linked above.

    The industry report concludes: “The proposed LightSquared plan . . .  will deny GPS service over vast areas of the United States.”
    In its decision document on January 26, the FCC not only authorized LightSquared to proceed, it turned up its nose at assertions that the entire process had been conducted in near-stealth mode as well as on an accelerated track.

    LightSquared was established in mid-2010 by “an experienced team of global telecommunications executives and investors.” From 2001 to 2005, Lightsquared executive vice president Jeff Carlisle served as deputy chief and then chief of the FCC’s Wireline Competition Bureau.

    See also “Act Now to Protect GPS Signal.”

    and

    “The FCC’s Decision on LightSquared: High-Precision Users Would Be Affected Most.”

    Galileo’s GATE Opened

    The Galileo Test and Development Environment (GATE) in Berchtesgaden, Germany, officially opened on February 4. The system operator, IFEN GmbH of Poing, Germany, jointly with the German Federal Minister of Transport, Building and Urban Development, announced the opening for use by commercial and organizational entities seeking to test equipment with the coming Galileo signals. GATE was developed on behalf of the German Aerospace Center (DLR) with funding by the German Federal Ministry of Economics and Technology.

    The test area extends across a valley of approximately 65 square kilometers, southeast of Munich, where antennae atop surrounding peaks broadcast the various Galileo signals. Technical details and specifications of the test environment are at www.gate-testbed.com.

    The GATE infrastructure is capable of transmitting the Galileo Open Service, the Safety-of-Life Service (functional, with certification as a next step), the Commercial Service, and a Public Regulated Service  dummy signal.

    The GATE system upgrade has been further extended to also support user integrity testing, simulating simple alarm-triggering events on the system/satellite level, supporting GPS and GATE/Galileo dual-constellation receiver-autonomous integrity monitoring (RAIM), individual user integrity test scenarios, and tests of receivers with different RAIM functionalities.

    Next-Generation GLONASS

    As this magazine goes to press, a Soyuz rocket carring a new GLONASS-K1 satellite has moved to the Plesetsk Cosmodrome launch pad for a scheduled blast-off on February 24. Assuming all goes well, the satellite’s eventual transmissions will include Russia’s new CDMA signal on a GLONASS L3 frequency. Further information and photos will be posted to env-gpsworld-integration.kinsta.cloud/glonassk.

    In Other Developments. Roscosmos, the Russian space agency, said it lost contact with a military satellite launched on February 1, a painful incident following the failed launch of three GLONASS-M satellites in December.

    The Geo-IK-2 satellite, designed for geodetic studies, remains in its transfer orbit because the upper stage failed to restart for its second circularizing burn. Based on the GLONASS-M bus, Geo-IK-2 carries laser reflectors, GPS/GLONASS receiving equipment, and an altimeter. Communications with the satellite have been re-established but it is not clear how useful it will be in its current orbit.

    Galileo IOV August Launch

    The European Space Agency announced that the first two Galileo in-orbit validation (IOV) satellites will rise on August 31. They will ride aboard a Soyuz-ST-B rocket from the Kouros, French Guiana, Space Center. There was no word about the third and fourth IOV satellites, which had at one point been scheduled for an October launch, at a time when the first two were penciled for a June launch.

    JAVAD Receivers Track Compass B1 Signal

    JAVAD GNSS has announced that, with modified firmware, all of the company’s receivers can now track the Chinese Compass B1 signal. The company states that Compass is the sixth GNSS system that its receivers can track, joining GPS, GLONASS, Galileo (the two GIOVE in-orbit validation experimental satellites), SBAS (the European Geostationary Navigation Overlay Service or EGNOS), and Japan’s Quasi-Zenith Satellite System (QZSS).

    JAVAD GNSS made available several plots, shown here. One is a log file, collected on JAVAD’s TR_G3TH board in Moscow during the last weekend in January, reporting up to 26 satellites from the various systems, locked simultaneously. Also provided below are several other plots showing the new capability.

    The company further stated that it will add Compass tracking to almost all receivers in near future, as a firmware upgrade.

  • Expert Advice: Jamming: A Clear and Present Danger

    SallyBasker_120By Sallie Basker

    A packed audience attended the National Physical Laboratory in the United Kingdom for a February 23 meeting titled, “GPS Jamming and Interference: A Clear and Present Danger,” organized by the Digital Systems Knowledge Transfer Network.

    In his keynote address, David Last described a dark, silent and dangerous world without GPS. He regaled attendees with tales from his experience as a GPS forensic expert, assisting the police who beat a path to his door bearing interesting boxes that turned out to be all sorts of jammers: of GNSS, of mobile phones, and of other radio systems. Last pointed to the near future when he believes that spoofers will undoubtedly make an appearance. The defences are limited: detection, prosecution, and the use of alternative sources of positioning, navigation, and timing information, perhaps eLoran.

    His final insight was this: “Navigation is no longer about how to measure where you are accurately. That’s easy. Now it’s how to do so reliably, safely, robustly.”

    Jim Doherty, from the U.S. Institute of Defense Analyses, discussed the use of existing resources for time and frequency backup. Drawing on his experience, Doherty delivered three overarching thoughts:

    • use all available means;
    • re-use existing systems where possible; and
    • produce integrated time and navigation.

    He advised the audience to be conservative with their designs and not to go too close to the boundary conditions. He also noted that there is an important trade-off between independence and cost when considering complementary systems. Finally, he identified a potential need for eLoran to support synchronisation in aviation’s multi-lateration systems.

    Moving on, Alan Grant of the UK General Lighthouse Authorities (GLA) described recent GPS jamming trials. He demonstrated that GPS jamming has wildly different effects, ranging from total denial to hazardously misleading information (HMI). HMI was particularly problematic: it caused the ship’s GPS receivers to report a realistic course and speed well away from the truth that was provided by the GLA’s eLoran system. He noted that the impact depends on the ship’s bridge design.

    Professor and consultant Martyn Thomas spoke on an ongoing Royal Academy of Engineering study on GPS vulnerability, which brings together experts from across the UK and will report in early June.

    This was followed by three presentations on coverage prediction by Robert Watson of Bath University, on interference detection using the U.S. National Geospatial Intelligence Agency’s GPS Jammer Location (JLOC) system by Alison Brown of NavSys Corporation, and on the GNSS Availability, Accuracy, Reliability anD Integrity Assessment for Timing and Navigation (GAARDIAN) interference detection system by Charles Curry of Chronos Technology.

    The conference audience learned that any system can be jammed, that JLOC detects thousands of jammers on a daily basis — nearly all of them unintentional — and that the GAARDIAN system has integrated GPS, eLoran, and clocks for interference detection and mitigation.

    Tom Willems from Septentrio and Peter McIlroy from Raytheon gave a good overview of what can be done with receivers and antennas. Willems focused on pulse blanking and adaptive notch filtering. He saw a clear trend towards hybridization, and confirmed that manufacturers recognise that GNSS is not a golden bullet — they can mitigate some interference but not all.

    Peter McIlroy told listeners to “defeat interference and jamming before you detect it.” This included hybridization with inertial systems, putting some form of barrier between the antenna and the jammer, and the use of controlled pattern-reception antennas. He suggested that controlled pattern-reception antennas might become available for civil use.

    Finally, Paul Groves from the University College London gave a very useful overview on positioning without GNSS. He addressed radio and non-radio systems and presented a fascinating chart that related the various radio systems in terms of range and lifecycle (Figure 1). The message was very timely given the need for complementary systems expressed by all speakers.


    FIGURE 1. Range and lifecycles of current radio systems (courtesy Paul Groves).

     

    I then chaired a lively panel discussion with David Last, Martyn Thomas, Charles Curry, Jim Doherty, and Tom Willems. I led off by focusing the discussion on resilient PNT, referring to the UK Center for the Protection of National Infrastructure’s definition for resilience: the equipment and architecture used are inherently reliable, secured against obvious external threats, and capable of withstanding some degree of damage.

    The panel agreed on the need for hybrid solutions with multiple technologies. It expressed concerns that cheap GPS receivers are components in many systems, and it is too easy to overlook them. Martyn Thomas brought insight from the computing world and noted that we need to avoid single points of failure and to demonstrate independence.

    Do our governments understand and should they do more? The panel thought that different governments are at different points on a journey, and that very few policymakers understand how a loss of GPS impacts critical national infrastructure. It was suggested that the European Union lags behind, due to the focus on Galileo.

    This led to an interesting discussion about economics and funding. Martyn Thomas said that GPS vulnerabilities have grown, and that GPS competitors have disappeared for economic reasons, leaving us dependent on GPS. He pointed out that there are limited mechanisms for sharing funding and questioned whether there are many (any) organisations that are prepared to take the risk.

    If you have limited funding, should it be used for detection or mitigation? The panel agreed that both were needed, but the prevailing view was that mitigation is more important, and that this needs to be supported by human factors activity.

    In Summary. GNSS interference is a real and present danger. It is probably more widespread than generally assumed, and it is here to stay. We can harden our GNSS systems with improved receiver and antenna design, but this will mitigate only some interference, not all. The problem is cost. Cheap — and vulnerable — GNSS receivers will inevitably find their way, unseen, to the heart of our critical infrastructure. We need resilient positioning, navigation, and timing based on independent and complementary systems and sensors. Demonstrating independence is vital but not necessarily straightforward, and true independence costs money. The greatest challenge is helping policymakers understand the risks of relying on vulnerable systems and the need for resilience.

    Finally, I return to Jim Doherty’s overarching thoughts: use all available means; re-use existing systems where possible; and produce integrated time and navigation.

    eLoran, anyone?

    SALLY BASKER is director of research and radionavigation for the General Lighthouse Authorities of the United Kingdom and Ireland.

  • Expert Advice: GPS Forensics, Crime, and Jamming

    Professor Emeritus David Last.
    Professor Emeritus David Last.

    By David Last

    The most widely used of all GPS devices are in-car navigators. When vehicles carrying navigators are used for criminal purposes, records contained in the devices may be examined. Such investigations rely on newly developed forensic techniques that employ a combination of computer expertise and navigation knowledge, yielding valuable data for crime investigators.

    Evidence from GPS-based tracking systems now fitted to a wide range of vehicles can be of even greater value. These installations, many of them covert, provide a history of vehicle movements. Forensic analysis of such records can provide evidence of considerable value in crime detection.

    Whilst the principal purpose of vehicle-tracking systems is generally to provide real-time information for efficient fleet control, they also serve an important security function. By continuously displaying up-to-date location information and identifying vehicles that deviate from planned routes or cross specific boundaries, they help protect assets that include the vehicles themselves and their high-value contents. Vehicle-tracking systems now constitute one of the most important GPS applications for our society.

    The recent appearance of readily available, low-cost GPS jamming devices presents a real and immediate threat to all such tracking and security systems. Criminals now employ jammers that can block both GPS reception and GSM in Europe, and U.S. and other mobile phone systems throughout the world, rendering vulnerable the use of GPS in critical security applications. Other global satellite navigation systems (GNSS) in development will likely share that vulnerability. While not yet deployed for criminal purposes, spoofers that mimic GNSS signals will pose an even greater threat to vehicle security than jammers.

    Alternative technologies, including enhanced Loran (eLoran), for vehicle navigation and tracking are not vulnerable to these threats, and promise a degree of protection to vehicle-tracking and recovery systems. These solutions will likely play an increasing role as GNSS jamming and spoofing activity increases.

    Vehicle Navigators

    Vehicle navigators often contain large numbers of records created by their users. These may show where they have been, how they got there, and a great deal more of value to investigators.

    The destinations stored in car navigators can be extracted, listed, and plotted. It is now possible to do this for virtually all makes and models of device, whether after-market installations or built in by the manufacturer. Such examinations must be conducted with great care, to maintain high forensic standards so the evidence will stand up in court. It is also essential to preserve that evidence. This requires screening receivers from incoming satellite signals during the examination; this can be very difficult to achieve given the exceptionally high sensitivity of current GPS receivers!

    Some car navigators disclose a great deal of information: who owns them; multiple addresses; a home address plus favorite addresses; destinations visited most frequently or most recently; the language spoken by the user, and other preferences; whether the user travels abroad; and occasionally telephone calls made and received. Some units even contain a detailed record of journeys stretching back over months, each point timed and dated (see Figure 1). These can provide compelling evidence of criminal activity.

    Figure 1. Detailed tracks of routes travelled by a vehicle, each point dated and timed.
    Figure 1. Detailed tracks of routes travelled by a vehicle, each point dated and timed.

     Tracking systems

    Probably the most impressive forensic evidence involving GPS comes from the tracking systems now fitted to increasing numbers of trucks, trailers, delivery vans, and rental cars. Each vehicle carries a receiver that records its location and sends it at intervals to a tracking center via mobile phone data services. The tracking center may store, process, and display the data on a map, and raise an alarm if a high-value cargo deviates from its planned route or if a rental car is about to be exported illegally. Many of these tracking installations are covert and very difficult to discover.

    When the police seize a tracking record, a forensic expert must audit the data in various ways, shown in blue in Figure 2. These focus on the many parts of the system the tracking company does not control. Tracking companies generally do not check the quality and accuracy of GPS at the time, and in the place, of a crime. A navigation professional, accustomed to dealing with high-integrity safety-of-life systems, can bring valuable experience to examining tracking records.

    Figure 2. Vehicle tracking system with checks (in blue) to establish quality of evidence.
    Figure 2. Vehicle tracking system with checks (in blue) to establish quality of evidence.

    It is also often necessary to estimate the accuracy of GPS fixes. Doing so may require analysis of complex situations. An example would be the GPS receiver in a covert tracking system, with its antenna hidden deep inside the vehicle, perhaps behind the dashboard. The vehicle itself might be surrounded by tall buildings that block and reflect satellite signals. This is a novel and fascinating area where navigation and forensic science meet!

    GPS Jamming

    The use of GPS jammers, long foreseen in navigation circles, has become a reality as criminals employ them to overcome tracking systems and steal vehicles. These low-powered transmitters (see photo), readily available over the Internet for as little as $150, can block GPS reception in a vehicle’s vicinity.

    GNSS satellites transmit no more power than a car headlight, yet must illuminate nearly half the Earth’s surface from 20,000 kilometers above it. Signals reaching a receiver are easily swamped by even a thousandth of a watt of jamming signal radiated near by.

    Figure 3 shows the spectrum of the signal radiated by the low-power jammer in the photo above it, plotted across a 100 MHz frequency range centred on the GPS L1 frequency at 1575.42 MHz. The total power this jammer radiates is only about one tenth of a milliwatt, yet that is sufficient to block commercial GPS receivers over a few meters range — all the criminals need.

    Low-power GPS jammer.
    Low-power GPS jammer.
    Figure 3. Signal spectrum radiated by low-power jammer.
    Figure 3. Signal spectrum radiated by low-power jammer.

    GPS/Phone Jammers

    If a vehicle is to be completely screened from electronic tracking, not only must GPS be disabled in its vicinity, so must mobile phones as well. If not, they can be used to call for assistance; they can also be tracked using cell-site analysis methods. To prevent that, a jammer (see adjacent PHOTO) can block not only GPS reception but also that of all the mobile phone bands used in the area. The spectra of the jamming signals radiated by this device are designed to cover the frequency bands in which European 900 MHz, 1800 MHz, and 3G base stations transmit, so preventing mobiles from receiving them and establishing communications.

    Recently, much more powerful jammers have appeared on the market (see adjacent photo). These radiate approximately two watts on each frequency, a power level some 20,000 times greater than the low-power jammer — and more powerful than the transmitter employed recently in official UK tests of effects on shipping of jamming GPS over a sector of the North Sea up to 30 kilometers from the jammer. A two-watt jammer could interfere over a substantial area.

    Other GNSS

    The spectrum in Figure 3 of the jamming signal of the simple low-power device extends from approximately 1563 MHz to 1600 MHz. Towards the center of this band is the civil GPS signal, approximately 2 MHz wide. The jammer also covers the 20-MHz-wide military P/Y signal, the yellow block. The slightly wider blue block represents L1 signals planned for Galileo, so this device would serve as a Galileo jammer, too. Its spectrum covers only the low end of the (purple) GLONASS bands, but other similar devices on the market jam that as well.

    It is often argued that, since Galileo will use more than one frequency band, simply jamming L1 would not prevent Galileo reception. However, the bottom photo shows a jammer that has recently come onto the market, with two transmissions: one covering L1; the other, at a higher power, covering the L2 band. Adding L5 would be trivial. These are the frequency bands in which present and planned GNSS operate.

    The jammers presented here are relatively simple and crude, but highly effective in preventing the operation of civil GPS receivers. They are readily available and are certainly being sold and being used. They render our GNSS-based security systems vulnerable to attack.

    More seriously, I believe that it is now technically feasible, though apparently not yet within the capabilities of criminals, to spoof GPS. When that happens, it will allow criminals to hi-jack and divert a vehicle whilst the tracking system shows it still following its planned route — no alarm will be raised. Vehicles will also be able to avoid purely GNSS-based road-user pricing systems.

    Last-Pics
    From left: Jammer for GPS, GSM (900MHz), DCS (1800MHz), and 3G mobile bands; high-power jammer for GPS and mobile phone bands; L1 and L2 jammer.

    Mitigation

    All is not lost! In many countries, vehicle-tracking systems such as Datatrak are deployed that do not depend on GNSS. There are also vehicle recovery systems such as Tracker with its LoJack technology installed in police cars and helicopters. These systems are immune to GNSS jamming and spoofing. Of course, like all radio systems, they can be jammed. But they are orders of magnitude less vulnerable than GNSS, and jammers that targeted them would be easier to detect.

    Dead-reckoning can also mitigate GNSS jamming. Many cars with built-in navigators carry heading sensors and wheel-rotation counters to cope with loss of GPS in tunnels and urban canyons. They are immune to jamming, at least for short periods and distances. But they would not necessarily be immune to GNSS spoofing.
    Enhanced Loran, or eLoran, offers a complete alternative navigation technology. Built into a GNSS receiver, it can take over seamlessly when GNSS is jammed, and replace precise GPS timing that currently keeps most of our telecommunications systems and the Internet running. There is great interest in this cost-effective insurance policy worldwide.

    Conclusions

    Legal and forensic aspects of GNSS grow ever more important, and their role more vital and successful in reducing crime. We must plan our responses to the vulnerability of our current and future GNSS-based security systems, which are now under attack. We must recognize these threats and encourage open and full discussion of them and of solutions to the dangers they pose.

    DAVID LAST is the immediate past-president of the Royal Institute of Navigation, a consultant and expert witness on radio-navigation and communications systems to companies, governmental and international organizations, and criminal investigators.