Recent GPS spoofing incidents along the Iranian border underscore the importance of training for “dead reckoning” capabilities, particularly at night and particularly if an aircraft’s navigation systems are more vulnerable to interference, warns Jan-Peter Van Viegen, the head of aviation for security firm Dyami. The incidents also underscore that GPS-reliant navigation systems can be vulnerable, he added.
At least a dozen aircraft flying along the Iraq/Iranian board on Airway UM688 had encountered the fake GPS signals. In most cases, the signals were of such integrity and strength that they caused a complete failure of navigation systems. This occurred without warning, and some operators found themselves 60 nm to 80 nm off course. The occurrence involved aircraft ranging from an Embraer Praetor 600 to a Boeing 777.
Van Viegen said these were not the first instances of GPS spoofing or jamming. He noted there have been various areas where GPS jamming—which causes intermittent GPS outages for a short duration—and perhaps less commonly spoofing occurred due to military exercises or geopolitical tension such as between Greece and Turkey or around Ukraine and Russia. There have been instances even along the suggested route of jamming or spoofing—but that has been 16 over five months versus a dozen in a short period.
However, he noted that of interest is how the most recent instances were spread all along the Iranian border, instead of just one location. “It's in a much greater area than where it's been discovered before,” he added.
“If you look at the map, it, they have three routes there, and UM688 is the closest one that passes the cross right next to the Iranian border,” Van Viegen said. This route has been more heavily used since the conflict began erupting in the Armenia/Azerbaijan region. “That's when a lot of rerouting started,” he said.
While Van Viegen called the spread of the fake GPS instances interesting, so too is the variety of aircraft, from large airliners to business jets—some of which “look a lot similar to airplanes that are used for reconnaissance…That could all be a coincidence.”
He further suggested that many others may have encountered the spoofing but the pilots didn’t notice and/or the aircraft’s backup systems protected against it.
Van Viegen expressed the grave safety implications in such instances. While these aircraft still have systems such as traffic collision and avoidance systems to help avert potential controlled flight into terrain or midair, wandering off course and into hostile territory makes these aircraft vulnerable to protective actions from the state involved—Iran in this case.
He also expressed concern about aircraft that are 100 percent reliant on GPS for positioning navigation, particularly when countries begin to eliminate traditional navigation systems such as VORs and non-directional beacons because they are no longer required. “These newer systems are 100 percent GPS,” Van Viegen said.
He further expressed concern that, unlike with the military, GPS for civil use in general is not encrypted, “so it's very easy to take over.”
According to Ops Group, noted in one incidence of the spoofing, it reviewed a report of a 777 en route “essentially asking ATC, ‘What time is it, and where are we?’ This scenario seems unthinkable—but highlights the potential problem that these new GPS spoofing signals present.”
As far as detecting the issues, he noted that on long flights, “you’re not looking at your [flight management system] continuously,” so brief navigational changes can go unnoticed. If the airplane recovers and maintains its original position, spoofing may not be discovered and will go unreported.
While notams have been issued and regulators such as EASA are aware, Van Viegen is concerned that more awareness of these issues needs to be raised.
Dyami provided a list of possible preventative measures, such as checking FIR notams for reported spoofing, performing a full IRS alignment if entering an area with elevated risk, and ensuring they have the correct time on their personal devices—but long-term, Van Viegen said he would like to see discussions on encrypted GPS for civil aviation similar to what the military has. The technology exists.
Unlike with drones, manned aircraft do have natural protections against bad actors trying to take over an aircraft, he noted. “We still have a human element. You can still disconnect [from the airplane navigation] and fly manually.”
But there has to be the recognition for a crew to take control before there is an airspace violation, “or in the worst case you get into, for example, Iran and they intercept you and make you land and confiscate the airplane and get the crew hostage.”
He added that’s what makes training so important. “They hardly do dead reckoning and they start right away in flight school with a [Garmin] G1000, or if they are lucky, they start with a G3000. But they stopped learning basic navigation.”
He further pointed out that GPS spoofing is not new to shipping, and in that case, celestial navigation is used as a mitigating measure. This is more difficult in airplanes, and ships have more time to turn course, he conceded. “In the aviation world, you have to act faster and you don’t want another MH17 [Malaysian Airline Flight 17 that was shot down over Ukraine in 2014] to happen because airplanes are getting lost flying over conflict zones.”
He further pointed to the difficulties of dead reckoning at night, whereas in the day pilots can look for a river, a road, or some other navigational landmarks. “But at night, with a cloud cover below, it's very difficult.”
In addition to training pilots, companies must make proper risk assessments. “They have to know what's going on—what's happening on the routes [to] the destinations,” he said, noting some operators try to save money in this area and rely on search engines, such as Google.
“You're not aware of what's happening for real, and that's the scary part,” he said. “We see that all the time. Complacency within flight departments is up there.”