GPS Spoofing: New Electronic Threat in Civilian Airspace

In 2023, at least 20 civilian aircraft flying through the Middle East were misled by their onboard GPS units into flying near Iranian airspace without clearance—situations that could have provoked an international incident. These planes were victims of GPS spoofing, in which deceptive signals from the ground, disguised as trustworthy signals from GPS satellites in orbit, trick an aircraft’s instruments into reporting the aircraft’s location as somewhere that it isn’t. Spoofing is a more sophisticated tactic than GPS jamming, in which malicious signals overwhelm a targeted GPS receiver until it can no longer function.

Long theorized, GPS spoofing attacks have increasingly cropped up in civilian airspace in recent years, prompting concerns about this new frontier in electronic warfare. IEEE Spectrumspoke with Todd Humphreys of the University of Texas at Austin about how spoofing works and how aircraft can be protected from it.

What is an example of a GPS spoofing attack?

Todd Humphreys: In 2017, we began to see spoofing attacks happening in the Black Sea. As time progressed, the spoofing has only gotten more sophisticated and more widespread. Nowadays, if you’re in the Eastern Mediterranean, and you’re on a flight bound for Turkey or Cyprus or Israel, it’s very likely that the GPS units in your aircraft will get spoofed. They will indicate a position at the Beirut airport or in Cairo. And it’s because Israel is sending out signals that fool GPS receivers for hundreds of kilometers around the country.

How can spoofing be detected?

Humphreys: It’s provable that you cannot, in all cases, detect spoofing. That’s because GPS is a one-way system. It broadcasts signals, but it doesn’t take any input from the receivers. So there’s always the possibility of somebody broadcasting a lookalike signal and fooling a receiver.

How can airlines reduce the chances of their planes’ GPS units being spoofed?

Humphreys: There’s an antenna on the front of large commercial aircraft, and in the aft also, there’s an antenna. Combining these together and analyzing the signals from them would enable you to detect almost all cases of spoofing.

So what’s the catch?

Humphreys: I spoke with Boeing about this many years ago. I said, “Look, I’d like to offer you a way of combining the signals from these two different antennas so that you could more readily detect spoofing.” And they pointed out that it was very important for their systems that these antennas operate entirely independently because they’re there for redundancy. They’re there for safety reasons.

Will the fight against spoofing always be an arms race?

Humphreys: There is often a trade-off between traditional safety on the one hand—and on the other hand, purposeful attacks from strategic adversaries. So it really depends on what you’re trying to protect yourself from. Is it that maybe one of your internal GPS antennas is just going to spontaneously fail, which does happen? Or is it that your most pressing fear is being caught in the crossfire of a war zone and having your GPS receiver spoofed without knowing? Unfortunately, it’s tough to address both of these problems with the same hardware at the same time.

This article appears in the January 2025 issue as “5 Questions for Todd Humphreys.”