Foto: iStockPhoto

Overview of recent jamming incidents and status of FOI GNSS jamming detection systemJouni RantakokkoDeputy Research DirectorFOI

Jamming

Threat

True positionFalse positionNoiseDeception

Where am I? I am at the red dot!

Spoofing

GNSS jamming affects GNSS users in northern Norway and Finland

GNSS spoofing in the Black Sea region (and around Kremlin)

The receiver can be fooled to provide a false PVT solution

Main reason for the sensitivitytowards jamming is the large distance

to the satellites

Overview of recent jamming and spoofing incidents against civil GPS receivers

Based on open media sources, see e.g. References

– www.tv2.no/a/10406767/– www.tv2.no/a/10449254/– Knut-Sverre Horn, Støy fra Russland slo ut GPS-signaler for norske fly. NRK Finnmark, 2017-10-05.

(https://www.nrk.no/finnmark/stoy-fra-russland-slo-ut-gps-signaler-for-norske-fly-1.13720305)– Knut-Sverre Horn, E-tjenesten bekrefter: Russerne jammet GPS-signaler bevisst. NRK Finnmark, 171006.

(https://www.nrk.no/finnmark/e-tjenesten-bekrefter_-russerne-jammet-gps-signaler-bevisst-1.13721504)– https://rntfnd.org/2017/10/27/russia-jamming-gps-official-norwegian-report/– Henrik Lied, GPS freaking out? Maybe you’re too close to Putin. NRKbeta, 2017-09-18.

(https://nrkbeta.no/2017/09/18/gps-freaking-out-maybe-youre-too-close-to-putin/)– GPS Spoofing Patterns Discovered. The Maritime Executive, 2017-09-26.

(https://www.maritime-executive.com/article/gps-spoofing-patterns-discovered)– Muhammad Darwish, Did Russia make this ship disappear? CNNtech, 2017-11-03.

(http://money.cnn.com/2017/11/03/technology/gps-spoofing-russia/index.html)– Michael Jones, Spoofing in the Black Sea: What really happened? GPSWorld, 2017-10-11.

(http://gpsworld.com/spoofing-in-the-black-sea-what-really-happened/)

Examples of incidents the last years GNSS jamming in the north

– 7-15 September 2017 (Zapad)– 16-20/10 & 24/10 – 7/11 2018 (Trident Juncture)– January 2019 – March 2019

GNSS jamming close to conflict areas – Ukraine– Syria (Nicosia FIR)– Libya

Spoofing – Black Sea and inside Russian territory (e.g. Kremlin)

GPS jamming incident Finnmarken, North of Norway

– 7-15 September• GPS-receivers on civil passenger aircraft jammed

on heights over 2000 feet– Nkom performed measurements

• 15-Sept-2017, four 360-degree measurements• Jamming detected on GPS L1 (BW ~1 MHz) and

L2 (BW ~12 MHz)• Jamming signal stronger towards east and

increased when the helicopter flew closer to the Russian border

• Jamming was turned off when the helicopter was close to the Russian border

https://www.nrk.no/finnmark/e-tjenesten-bekrefter_-russerne-jammet-gps-signaler-bevisst-1.13721504

https://rntfnd.org/2017/10/27/russia-jamming-gps-official-norwegian-report/ (Google-translated version)

GPS jamming incident

What was the reason?– The jamming occurred prior to the

official start of Zapad 2017– Norwegian officials state that this

incident was not directed towards Norway, but rather a part of the Russian Zapad exercise

”I forbindelse med øvelse Zapad 2017 kan E-tjenesten bekrefte at vi både har registrert og varslet norske myndigheter om elektronisk jamming fra russisk side.””Vi vurderer att dette ikke var rettet mot Norge, men varmomenter i den russiske øvelsen.”Kim Gulbrandsen, E-tjenesten

https://www.nrk.no/finnmark/e-tjenesten-bekrefter_-russerne-jammet-gps-signaler-bevisst-1.13721504

Finland

Russia

GPS jamming during Trident Juncture

Deliberately targeting the Trident Juncture exercise– Jamming “heat maps” shown by Norwegian

military intelligence– Localization of jamming source, which moved

from Luostari base to higher altitude at Sjartraining area

www.tv2.no/a/10406767/

GPS deception incidents

Novorossijsk, Black Sea region– June 2017 ?

https://nrkbeta.no/2017/09/18/gps-freaking-out-maybe-youre-too-close-to-putin/https://maritime-executive.com/editorials/mass-gps-spoofing-attack-in-black-sea

“GPS equipment unable to obtain GPS signal intermittently since nearing coast of Novorossiysk, Russia. Now displays HDOP 0.8 accuracy within 100m, but given location is actually 25 nautical miles off; GPS display…”

The

Mar

itim

e Ex

ecut

ive

(Fot

o G

urva

n Le

Meu

r, M

aste

r on

the

oil t

anke

r Atri

a)

Illustration: Henrik Lied/CartoDB

Post-analysis of maritime AIS-data─ Close to 450 different instances when a

ships position was falsely reported as being on different Russian airports

Henrik Lied, NRK/Marinetraffic.com

GPS deception incidents

Why?– The theory proposed in media is that it is

performed as a protection of places where the president is located• Since the summer of 2016 there have been

numerous reports about deception of GPS-receivers near the Kremlin

• President Putin has a summer residence near Gelendzhik

• Anti-drone protection (through airport geofencing)https://nrkbeta.no/2017/09/18/gps-freaking-out-maybe-youre-too-close-to-putin/https://www.youtube.com/watch?v=PRlxSF5bwTI

Gelendzhik

GPS deception

Threat from GPS deception has increased dramatically the last couple of years– Deception equipment used to be an expensive,

exclusive resource; the hardware is now inexpensive (e.g. HackRF One SDR)

– Software easily available on the internet; no expert knowledge is needed

https://nrkbeta.no/2017/09/18/gps-freaking-out-maybe-youre-too-close-to-putin/

FOI RF Oculus Detection System

Aim

Detect interference signals ─ Primarily in the GPS L1 band─ Save raw data (I/Q) and GNSS Rx data at detections

Relatively low-cost and compact mechanical enclosure Remote control and continuous monitoring (24/7)

Internet

Spectrum monitor

Remote control

History

2013 2014

Internal development

SwedaviaCustomer X

Prototype Version 0.5 Version 1.0 Version 1.5

Swedavia Swedavia

Version 2.0

2015 2016 2017 2018 2019

H2020 - STRIKE3, 3 år

Version 2.1

Portable detection system, v2.0

Node N

Detector

Remoteconnection

Node 1

Detector

Remoteconnection

Node 2

Detector

Remoteconnection

Server

Remote supervision and control

Detections analyzed off-line at FOI

Web-based set upContinuous monitoring

of L1 power levelsSave I/Q-samples,

Rx data and additional parameters at detections

Report created after detection and emailed Smaller size (20x30x11 cm)

New power unit (9-36 VDC), enables mobile/air/vessel use

Software Defined Radio (SDR)

USRP B200 mini─ Standard product (ETTUS)─ The first fully integrated USRP device

with continuous RF coverage from 70 MHz – 6 GHz

─ Full duplex operation with up to 56 MHz of real time bandwidth (61.44MS/s quadrature)

─ Fast and convenient bus-powered connectivity using USB 3.0

Visualization, web-based GUI

RF Oculus

Use cases– Swedavia (Swedish Airport

administration)– FMV (Swedish Defense

Material administration)– Swedish Police– H2020 Project STRIKE3– Swedish Customs

The future?– Automatic classification

(intentional, jammer type)– Detection of spoofing– Localization and/or DF– Ground-based national

detection network– GNSS-receivers should have

built-in detection capability (and incident reporting)

Summary

Recommendations

Civil community– Important that civilian actors prepare to meet the threat against

GNSS from jamming and spoofing– Possible to achieve significantly higher robustness with relatively

simple means, but economic incentives for investments have not yet been there• By spreading information about these and similar incidents, the hope is that

such investments may gain a higher priority

Cooperative navigation, e.g. ranging & information exchange

Robust multisensor navigation system?

Robust GNSS-receivers

Jamming and spoofing detection

& mitigationAdaptive

antennas (CRPA)

Multi-frequency, multi-constellation(e.g. GPS & Galileo)

NAVWAR-prepared (M-code & PRS)

Complementary navigation tech’s

CSAC

Magnetic & gravitational

fields

Landmarks / environmental

features

Gyro & acc

Celestial

3D-maps

Detect & exclude unreliable constellations & PR’s

Atom interferometry-based INS…?

Opportunistic use of radio signals

Air pressure

Opportunities

Velocity

Bildnummer 1Bildnummer 2Bildnummer 3Based on open media sources, see e.g.Examples of incidents the last yearsGPS jamming incidentGPS jamming incidentGPS jamming during Trident JunctureGPS deception incidentsGPS deception incidentsGPS deceptionBildnummer 12AimHistoryPortable detection system, v2.0Software Defined Radio (SDR)Visualization, web-based GUIRF OculusBildnummer 19RecommendationsOpportunities