# Presentation: 534106

## 4th CGSICAustralian Meeting

**4****th**** CGSIC****Australian Meeting**

**Surfers Paradise, QLD Australia**
**17 July 2006**

## GPS Potential Vulnerabilities

**4th CGSIC Australian Meeting**

**Notes:**
-In recent years, the potential for intentional, malicious disruption of GPS has been recognized
   --The civil infrastructure is relying more and more on GPS for operations
   -- Homeland Security can become a potential threat  

## Background

- US DoT/Volpe Center’s 2001 report
- Examined potential vulnerabilities to civilian systems
- Transportation, telecommunications, and electronic finance
- Vulnerability – why an issue?
- GPS receivers derive solutions from extremely low-power satellite signals
- These signals – like any radio transmission – can be jammed
- Worldwide use of GPS for military applications has driven the development of a ‘GPS disruption industry’
- GPS jamming techniques are no secret
- Simple plans for building jamming devices are readily available
- A number of them are available for purchase

## GPS Applications

- Military
- Civil
- Transportation
- Aviation
- Automobile
- Maritime
- Rail Control
- Public Services
- Timing & Frequency
- Surveying
- Surveillance
- Other

**Notes:**
-Transportation is another application that relies heavily on GPS
   --Specific systems in each of the sub-categories of transportation will be described in the section

## Military GPS Reliance

- Military
- GPS is an effective force enhancer to the military
- Forefront of developing anti-jam technology
- US produced solutions making military navigation systems much more robust than their civilian counterparts
- But, a minority user

## Civil GPS Reliance

- Commercial applications of GPS far exceed those of the military
- GPS satellites broadcast a signal freely available to the public
- Openly published GPS specifications allow anyone to build receivers (no licensing fees)
- Innovative applications
- Using GPS in ways that the original developers could have never imagined
- Profoundly affected the way we live, communicate and travel
- Potential applications of GPS are vast and nowhere near maturity

## GPS Usage

- Despite Volpe Report, commercial use continues to increase
- We encourage it!
- US policy is to promote acceptance and use of GPS
- Its low-cost and worldwide availability make it extremely attractive for all of its applications
- Users beware...
- Civilian infrastructure is not invulnerable to deliberate attack
- Must proactively identify potential weaknesses
- Implement appropriate mitigation strategies

## Message to Civil GPS Community

***GPS provides many benefits to civilian users.  It is vulnerable, however, to interference and other disruptions that can have harmful consequences.  GPS users must ensure that adequate independent backup systems or procedures can be used when needed.***
- SOURCE:  Interagency GPS Executive Board. _[GPS policy, applications, modernization, international cooperation](http://www.igeb.gov/outreach/feb2001/main.ppt)__.  February 01_

**Notes:**
•  Right now, unintentional disruptions occur fairly often (e.g., Florida ~ 2/8/01).

•   Besides backup systems, user training for awareness of when to switch to  backup, etc., are important

## GPS System Vulnerabilities

- Unintentional Interference
- Radio Frequency Interference (RFI)
- Ionospheric;  Solar Maxima
- Spectrum Congestion
- Intentional Interference
- Jamming
- Spoofing – Counterfeit Signals
- Human Factors
- User Equipment & GPS Satellite Design Errors
- Lack of Knowledge/Training
- Over-Reliance

**Notes:**
SPOOFING – SPAWAR Meeting Reinforces its Importance as a Potential Threat, Along with RFI and Growing Dependence on GPS.

Meaconing is the Delay and Re-broadcast of the GPS signal.

UNINTENTIONAL INTERFERENCE GENERALLY IS SHORT_TERM

INTENTIONAL INTERFERENCE USUALLY IS SHORT TERM ALSO, BUT SYSTEM DAMAGE CAN BE LONG TERM.

GPS Constellation Damage – Space Attack

Ground Control Damage – Natural disaster (quake?);  Terrorist or Missile.

HUMAN FACTORS – Royal Majesty incident epitomizes this issue.

MORE DETAIL – NIST Charts #17 & 18.

## Factors Impacting GPS Vulnerability

***Factors Impacting GPS Vulnerability***

- Very Low Signal Power
- Jamming Power Required at GPS Antenna on order of a Picowatt (10-12 watt)
- Single Civil Frequency
- Known Signal Structure
- Many Jammer Models Exist
- KWatt to MWatt Output – Worldwide Militaries
- Lower Power (<100 watts)
- Easy to Make
- Jamming Signal Types
- Narrowband
- Broadband
- Spread Spectrum - PRN Modulation

- A 100 Watt bulb is
- 1018 times more
- powerful than a GPS
- satellite signal at the
- receiver’s antenna!

## Disruption Mechanisms - Spoofing/Meaconing

- Spoofing – Counterfeit GPS Signal
- C/A Code Short and Well Known
- Widely Available Signal Generators
- Meaconing – Delay & Rebroadcast
- Emerging Threat
- German Patent
- Possible Effects
- Long Range Jamming
- Injection of Misleading GPS Information
- No “Off-the-Shelf” Mitigation

**Russian Jammer**

**Notes:**
DRFM = Dynamic RF Memory.    ADC = Analog/Digital Converters.
Given the bandwidth, these components can execute the capture in the required time.

## Risk Considerations

**Consequences** of GPS
- Loss:

**Probability** of
- Loss/Degradation of
- GPS Signal

**Threats** –

***RISK***

-   Human Life & Health
-   Environment
-   Economy

- GPS System
**Vulnerabilities**

-   Unintentional
-   Intentional

- Source:  John A. Volpe National Transportation Systems Center.  _Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System._  29 Aug 01

**Notes:**
RISK TO USERS !!!

THERE WAS NO THREAT ASSESSMENT;  THIS NEVERTHELESS IS VERY IMPORTANT IN DEVELOPING THE OVERALL PICTURE.

## Consequences of GPS Loss/ Degradation

- Depending on ...
- Application Mode Involved
- Duration of GPS Loss/Degradation
- Impact Can Be
- _Minimal_  -  Quick Recovery
- _Operational_  -  Reduced Effectiveness & Efficiency
- _Safety_  -  Potential Loss of Life, Environmental,
-                  Economic Damage
- Timing & Synchronization
- GPS Outage Can Disrupt Communications/Networks

**Notes:**
#2  Reduced Effectiveness = Safe Operation

       Safety impact uses = “Critical Applications”

#3  Serious Consequences if Loss Lasts Days & if No Backup Accurate Clock.

Timing Linked to Transportation, Commerce, Banking, Web

## Real-world GPS Disruptions 

- Jamming in Mesa, AZ
- 13 – 18 Dec 01, GPS jammer caused GPS failures within 180nm of Mesa, AZ
- Boeing was preparing for upcoming test
- Accidentally left Jammer on L1 frequency radiating at 0.8mW
- Jammer operated continuously for 4.5 days
- Impact to ATC operations
- Aircraft lost GPS 45nm from Phoenix, performed a 35° turn toward traffic
- NOTAM was not issued until 2nd day
- Numerous pilots reported loss of GPS
- Reports of hand-held GPS receivers not working

## Real-world GPS Disruptions 

- Jamming in Moss Landing Harbor, CA
- 15 Apr 01 – 22 May 01, VHF/UHF television antenna with pre-amplifier caused GPS failures to all of Moss Landing Harbor
- Boat owner purchased TV antenna, which was equipped with pre-amp
- From interior location Amp’s emitter jammed all of Moss Harbor and 1km out to sea
- No GPS in entire area = 37 days
- Impact to Moss Harbor
- Research vessels relied heavily on timing from GPS
- Extreme difficulty going through harbor in foggy conditions
- Notification to all vessels in area that GPS was down
- Switched back to radar control for harbor entrances

## An Australian First

“4.	Prohibition relating to RNSS jamming device

	For section 190 of the Act:

	(a) the operation or supply of a RNSS jamming device is prohibited for the reasons mentioned in section 5; and

	(b) the possession, for the purpose of operation or supply, of a RNSS jamming device is prohibited for the reasons mentioned in section 5.

	Note Under section 189 of the Act, while this Declaration is in force it is an offence for a person to operate or supply a RNSS jamming device, or to possess a RNSS jamming device for the purpose of operating or supplying the device.”

**“****4.****	****Prohibition relating to RNSS jamming device**
- 	For section 190 of the Act:
- 	(a) the operation or supply of a RNSS jamming device is prohibited for the reasons mentioned in section 5; and
- 	(b) the possession, for the purpose of operation or supply, of a RNSS jamming device is prohibited for the reasons mentioned in section 5.
*	**Note *Under section 189 of the Act, while this Declaration is in force it is an offence for a person to operate or supply a RNSS jamming device, or to possess a RNSS jamming device for the purpose of operating or supplying the device.”

***RNSS Jamming Prohibition***

## RNSS Jamming Prohibition

**5****	****Reasons for prohibition**
- 	For section 4, the reasons are:
- 	(a)	that there appears to be no legitimate radiocommunications use for a RNSS jamming device; and
- 	(b)	that the only purpose of a RNSS jamming device is to adversely affect, interfere with, disrupt or 	disturb the reception of RNSS radiocommunications by RNSS receivers; and
- 	(c)	that adversely affecting, interfering with, disrupting or disturbing RNSS would inconvenience RNSS 	users and could threaten public safety; and
- 	(d)	that the operation, or the possession for the purpose of operation, of a RNSS jamming device may 	contravene sections 46 and 47 of the Act; and
- 	(e)	that the operation of a RNSS jamming device may also contravene sections 192, 193, 194, 195 	and 197 of the Act; and
- 	(f)	that the prohibition of the operation or supply, or possession for the purpose of operation or 	supply, of a RNSS jamming device will:
- 		(i) ensure the reliability and quality of RNSS by minimising the potential for interference with 	radiocommunications for RNSS; and
- 		(ii) increase the awareness of the public and of suppliers of RNSS jamming devices, 	potentially minimising the need for regulatory action in relation to RNSS jamming devices.

## Reducing Vulnerabilities

**Modifying GPS architecture to offer civilian users free access to three satellite signals**
- This will take some time to implement
- 2nd signal not available before 2008
- 3rd signal is not expected before 2012
**Micro-electromechanical systems (MEMS)**
- Embedding small inertial navigation sensors inside GPS antenna would help improve a system’s anti-jam performance
- Not adequate to support this yet, continue to improve significantly
**Jamming Detection**
- Angle of Arrival (AoA)
- Time of Arrival (ToA)
- New concepts need to be developed that are cost effective

## Conclusion 

- Civilian systems rely heavily on GPS
- Potential applications of GPS are vast and nowhere near maturity
- Potential serious economic and potentially fatal consequences if signals are disrupted
- GPS is a tempting target for adversaries
- Continues to penetrate civil infrastructure
- GPS users are vulnerable to signal loss or degradation
- The vulnerability will not be fully eliminated
- Awareness and planning can mitigate the worst vulnerabilities

## Recommendations

**Study vulnerabilities to determine tolerable levels of risk and cost for critical infrastructure applications**
- Determine costs of lowering risks to an acceptable level (ALARP)
- Implement appropriate mitigation strategies
**For each application, choose or maintain appropriate backup system or procedure **
- Reflect interference impact in application designs
- Implement systems to monitor/report/locate interference
- Assess applicability of military anti-jam technology
- Be cognisant of timing applications
**Encourage user training and use of backup systems**

**Notes:**
#1  Convince service providers & users of need to mitigate the vulnerabilities.

#2  Routinely Validate GPS With Other Information Sources.

## Questions