At the end of June, at least 20 ships in the Black Sea were hit by what appears to be the first documented case of GPS misdirection used as an attack, also known as spoofing. The affected ships’ GPS systems incorrectly placed them 32 km inland, at Gelendzhik Airport.
GPS spoofing is caused by sending a false signal from a ground station, which confuses the receiver, potentially luring it off course. Experts think that this episode may be a sign of Russia experimenting with a new cyberweapon, as GPS spoofing has been occurring in central Moscow over the past year. A fake signal centred on the Kremlin redirects anyone nearby to Vnukovo Airport, 32 km away – playing havoc with phone apps (the scale of problem was apparently first revealed when people tried to play Pokemon Go).
While the spoofing at the Kremlin has good defensive reasons – guided bombs, missiles and drones rely on GPS to hit their targets – a spoofing attack on distant ships has worrying implications.
GPS spoofing affects all systems within range of the signal. David Last, former head of the UK’s Royal Institute of Navigation, thinks that the Black Sea incident suggests a new device has been developed, capable of causing disruption and confusion over a large area: “My gut feeling is that this is a test of a system which will be used in anger at some other time.”
This apparently long-range attack may also indicate that GPS spoofing is becoming easier. It has required sophisticated technical expertise until very recently, but experts now think it can be done by competent hackers using commercial hardware and software from the internet. Short-ranged systems can be potentially be used to hijack or divert individual driverless vehicles or autonomous ships.
The insidious nature of spoofing makes it harder to detect than GPS jamming, which simply swamps signals with noise, usually causing receivers to set off alarms. As David Last notes, “Jamming just causes the receiver to die, spoofing causes the receiver to lie.”
After fake news, could fake GPS be the next form of disinformation with systemic implications?