Measured GNSS Jamming Events at German Motorways

Transcription

1 Measured GNSS Jamming Events at German Motorways Mirko Stanisak 1, Karen von Hünerbein 2, Ulf Bestmann 1, and Werner Lange 2 1 Technische Universität Braunschweig, Institute of Flight Guidance, Braunschweig, Germany 2 Lange Electonic GmbH, Gernlinden, Germany With Global Navigation Satellite Systems (GNSS) being increasingly used in safety-critical applications, the impact of intentional as well as unintentional jamming keeps gaining significance. Broadcast by satellite s thousands of kilometers away, GNSS signals are received by the users at a very low power level and are thus susceptible to different types of Radio Frequency Interference (RFI) even if the transmitted power level is not overly high. Thus the continuity and reliability of operation can be disturbed very easily, even for safety-critical applications like distributed networks or critical navigation infrastructure. This is especially important as multiple types of Personal Privacy Devices (PPDs) are available to users. These PPDs are blocking GNSS and mobile communication networks and are increasingly used as counter-measures against GNSS based tracking devices by car drivers. Despite being illegal in most countries, the use of PPDs has been demonstrated in several countries around the world previously. For Germany however, little evidence of real-life jamming has been presented up to now. In order to assess the quantity and impact of PPDs at German motorways, an RFI Detection system has been installed in Braunschweig in close proximity to a motorway and an airport. This system automatically detects interference events and can also prioritize and characterize the events. In addition, recorded data of a high-grade GNSS receiver has been used to analyze the influence of the detected events on real GNSS receivers. Based on these results, certain counter-measures and further tests are suggested. 1 Introduction Over the last years, the number of application of Global Navigation Satellite Systems has increased dramatically in almost all areas of transportation, geodesy, timing of base stations and power grids and in all areas requiring very accurate position, velocity and timing. Most cars contain GPS based navigation systems and even many airplanes are equipped with avionics containing a GPS component. In aviation, GNSS is widely used, too. However, due to the required navigation performance, additional techniques are neccessary in order to meet the requirements on accuracy, availability, continuity and integrity. These requirements depend on the criticality of the consequences of a fault. If any positioning fault could possibly have catastrophic results, this system has to be considered being safety-critical. One example in the aviation domain is the Ground Based Augmentation System (GBAS). This system can be used to perform precision approaches without visual references, thus each failure could lead to a catastrophic event. GBAS consists of a ground installation at an airport providing differential GNSS corrections and integrity information via a VHF data link. The differential corrections are calculated based on reference

2 GNSS receivers at the airport. Using this data link and complex integrity algorithms, GBAS is foreseen to even support approaches in low-visibility conditions. Satellite navigation allows accurate positioning and timing anywhere on Earth with a very high availability. However, as the GNSS signals are received at very low power levels (approx. 130 dbm to 1 dbm), satellite navigation is susceptible to multiple external error sources such as atmospheric disturbances, multipath, jamming and spoofing. GNSS signals can be easily overpowered by other radio signals in the same band. Such radio signals can be emitted and generated unintentionally (e.g. due to defect devices or intermodulation effects of several RF transmitters) or intentionally (e.g. by jammers attempting to disrupt GPS signal reception). Jammers work by transmitting relatively high power RF signals in the same RF band, and simply overwhelm the GPS receiver by sheer noise. [7] This effect is not limited to the position of the jammer or the vehicle it is located in, but affects an area around it of several hundred meters to several kilometers. Jamming is not a highly selective process and can affect numerous unintended targets. [17] Several classes of jammers have been described, emitting either noise, or CDMA (Code Division Multiple Access), pulsed jammers, continuous chirp signals, pulsed chirp signals, frequency hopping signals or occasional frequency hopping[14]. In case of jamming attacks, GNSS receivers fail to track the GNSS satellites due to the superimposed signals of the jammer received at higher power. In recent years, many jamming events have been reported.[7, 16] One striking example was Newark Airport in New Jersey, where jamming has occurred since 09, with vehicles on the nearby New Jersey Turnpike using Personal Privacy Devices PPDs to conceal their route.[4] These jamming devices emit RF signals in the GPS L1 frequency band with a high signal power that is not confined to the vehicle it is aiming to protect, but has a significant effect on the signal environment for tens to 100s meters around it with the potential to block or interrupt other GPSs receivers operation.[15] Hundreds of jamming events have happened at Newark Airport since March 11 with a great diversity of different PPDs used, as can be inferred from the analysis of their RF spectra.[4] Some of the interference events prevented the airport s GBAS Ground Based Augmentation System GPS satellite reception for several seconds at a time causing system shutdowns and thus seriously interfering with the operations of the Ground Based Augmentation system. Newark is not the only airport in the US that has been affected.[1] Jamming by commercial devices was also detected on the French motorway A1, located 35 km North of Paris.[14] Above that motorway, a DETECTOR device was installed on a toll collecting bridge. This DETECTOR device for the detection of GPS and Galileo jamming signals was developed by AGIT and NSL (Nottingham Scientific Limited), as a result of a European FP7 Research and Development project. Within a short time about 1000 interference events were detected at this tollbridge, 59 of these were clearly identified as Chirp or CDMA jammers. The other events comprised 432 wideband interferences (White WideBand) and 519 narrow band, single-tone interferences. The 59 jammers were individually identified and re-detected by their RF signature. One jammer passed the toll bridge repeatedly on different days during the afternoon.[14] In July 03, it was reported to the Federal Aviation Administration (FAA) that a cellular phone, when turned on, simultaneously interfered with three different aircraft GPS receivers, causing complete signal loss. The three GPS receivers were using three separate antennas, and were installed on a small aircraft. The phone was on, however, calls were not made during the incidents and subsequent tests. [2, 11] Most events have been reported from the US, France, England, South Korea and France. So far, there has been little evidence of GNSS jamming in Germany. Thus, we have installed the above mentioned DETECTOR test system at the Institute of Flight Guidance IFF at the TU Braunschweig in close proximity to the A2 motorway and the research airport Braunschweig. The DETECTOR, monitors the GPS signal environment continuously, detects jamming events, classifies them, sends alerts to users and stores snapshots of spectra and spectrograms. In this paper, we would like to present the results of 14 days of field tests at IFF earlier this year, in order to get a first picture of the amount of RFI events on German motorways and their possible threat for safety-critical GNSS aviation systems.

3 2 GNSS Interference Detection System The interference detection system used for this work is a new product which was originally developed by NSL Nottingham Scientific Limited in the UK in a joint EC project with five other European organizations, and has been launched as a cooperation between NSL and Spirent Communications. The DETECTOR constantly monitors the live GNSS RF signal environment at ±8 MHz around the L1 center frequency, detects jamming events, classifies the impact of a jamming event, characterizes the waveform and type of interference, notifies the user via about serious events and stores snapshots of 100 µs lengths of spectrum and spectrogram, ±50 µs from the peak. Thus, the GSS100D does not only detect interference events, but also analyzes the jamming signals frequency properties, signal strengths and potential impact on a GPS receiver. In addition, the snapshots can be converted into test cases for a GNSS and interference simulator system, enabling repeated and controlled testing of real jamming events in the laboratory. The access to the jamming event data is enabled via a web based service: all events are sent to a central webserver via internet, allowing the user to access an overview over all events listed in a table on a web portal. This can be either a Spirent web portal or a user specific private network. The web portal table allows viewing of the spectrum and spectrogram snapshots. The online table grants an easy access to the data and a fast impression about the amount and severity of jamming events at the test location of the active DETECTOR or even at several test locations, without a need for the user to manually sort and look through a huge amount of recorded data and without extensive computations. The detected events can be filtered according to their priority (severity) and exported into comma separated value (CSV) files for further analysis. This exportable data contains the start date and time, the duration, the detected type of signal, the estimated signal strength and the severity for each event. Additionally, each event is tagged with a unique event ID. The detection function is accomplished using a fusion of complementary pre- and post-correlation techniques. The detection fusion algorithm is patented. Pre-correlation algorithms make use of the digital signals at baseband or intermediate frequency (IF) which are available in the software receiver in the GSS100D. The post-correlation algorithms use measurements, which are typically available as outputs from a standard GNSS receiver, such as signal to noise rations (SNR), numbers of satellites tracked, automatic gain control (AGC) parameters and satellite geometry information. After the first level signal classification at the GSS100D Detector Probe hardware, the captured interference event is then transferred to the server for further characterisation....the classification approach used assigns a threat level severity metric to the event. Events are automatically ranked according to a priority score based on the likely impact to GNSS services.... High priority events as assessed as likely to prevent all receivers in the vicinity from acquiring and tracking satellites. Medium priority events are assessed as likely to prevent positioning for more susceptible receivers and may measurably degrade positioning for more robust receivers. Low priority events are assessed such as they may degrade positioning on more susceptible receivers but not affect more robust devices. Very low events are genuine detections of interference, which may be of interest for related investigations, but are at a level which is unlikely to have a noticeable impact on any GNSS receiver. [18] 3 Measurement Setup For a two-weeks test campaign, the Sprirent DETECTOR system has been installed at the Institute of Flight Guidance (IFF) of the Technische Universität Braunschweig (TU-BS). As shown in Figure 1, the location of this institute is favorable for these kind of tests for two reasons.

4 Figure 1: Map of the motorway A2 (south, red) along the Research airport Braunschweig / Wolfsburg (north, gray). The location of the DETECTOR system at the Institute of Flight Guidance is indicated with a red circle. Map data (c) OpenStreetMap On the one hand, being located in close proximity to the Research Airport Braunschweig / Wolfsburg, it can be taken as a good example for a location within larger airports for safety-critical GNSS components (like a GBAS ground installation). The distance to the runway is just 560 meters. On the other hand, it is located next to the German motorway A2. This three-lane autobahn is one of the main transfer routes in the East-West direction, connecting Berlin via Hanover with the Ruhr valley. Each day, more than 80,000 vehicles pass the motorway here.[12] Figure 2: Photo of the roof-top installation of the DETECTOR antenna. The motorway A2 can be seen in the background. As shown in Figure 2, the DETECTOR antenna has been mounted on the roof-top of the institute. The spatial situation with respect to the motorway is shown in Figure 3. Additionally, the Institute of Flight Guidance operates a continuously operating reference station using a high-grade choke-ring antenna connected to different GNSS receivers. This reference antenna is located on the same antenna platform as the DETECTOR antenna and can be used to characterize the real-world influence of the detected events on commercial-grade receivers.

5 Antenna Motorway (three lanes per direction) Noise Barrier Figure 3: Sketch of antenna setup in the vicinity of the motorway In contrast to the patch element antenna used by the DETECTOR system, the reference receiver is connected to a choke-ring antenna with a totally different reception characteristics. For example, chokering antennas are less sensitive at low elevations in order to minimize multipath reception. Thus, in our setup the reference choke-ring antenna is supposed to be less susceptible to interference coming from the motorway than the DETECTOR patch element antenna. 4 DETECTOR Findings The DETECTOR system was in continuous operation from February 12th to 26th 16. During this period of time, 238 interference occurrences have been detected and reported by the DETECTOR system. These events have been classified by the DETECTOR in the nine distinct types that are shown in Table 1. DETECTOR Name Events Description WHITE_OR_WB 121 (66/51/1/3) Wide-band random jamming, or jamming so weak that the system detects only noise. NB 47 (10/10/13/14) Narrow-band jamming. VNB 44 (6/21/8/9) Very narrow-band jamming. ST 14 (2/4/5/3) Single tone signal. CHIRPSAWTOOTHUP 4 (0/0/0/4) Spectrally periodic jamming, with frequency sweeping across the band. SPECPERUNK 3 (1/2/0/0) Specrally periodic jamming the system is unable to classify. CDMA 2 (0/1/0/1) CDMA-like signal (Code Division Multiple Access), similar or identical to a GNSS signal. ST_OR_NB_OR_BPSK 2 (2/0/0/0) Either BPSK (Binary Phase Shift Keying) or narrow-band or single tone signal. PULSEDWHITE_OR_WB _OR_NB_OR_ST 1 (0/1/0/0) Pulsed random signal. Table 1: Detected types of events and the corresponding color coding. The number of events are detailed by the priority: (Very Low / Low / Medium / High). White Noise or Wideband represents a general more type of interference, and could be caused either by simple jammers or by collateral emissions of other electronic devices. Collateral emissions of other electronic devices have been observed by automotive manufacturers and researchers, and were caused for example by built-in cameras and SSD disks. There are legal sources of interference, too. One example in the aviation domain is the Distance measuring equipment (DME). The ground stations of this well-established system for distance measurements operate

6 in close proximity to the L5 band and can cause interference in this band. As the DETECTOR only supports interference detection in the L1 band, none of jamming events described here were caused by DME transmissions. Other potential sources for unintentional interference can be broken electronic devices (e.g. leaky GNSS reception antennas), RF emissions from welding workshops, unforeseen harmonics generated by intermodulation effects, when transmitter waves of several different radio, TV and mobile phone transmitter stations interact. This type of interference it likely to appear as Narrow Band or Very Narrow Band signals. The impact of the narrow band signals depends on the proximity to the center frequency on GPS within ±1 MHz, as the GPS C/A signal is 2 MHz wide. The closer the Narrow Band or very Narrow Band peak is to the center frequency of MHz the more detrimental it will be to the GPS signal reception. Chirped sawtooth formed interference signals are most probably caused by Personal Privacy Devices (PPD) in a car or a truck. This kind of jamming is used with the intention to prevent GPS/GNSS reception. In some places and airports GPS repeaters are used. If no proper care is taken, the repeated signals can leak out of doors and windows and interfere with the regular GPS signals. As shown in Figure 4, the DETECTOR events are not correlated with time, but are more or less distributed uniformly. Figure 5 shows a histogram of the severity of the different detection types Power Level February 16 Figure 4: Detected interference events over time. Event types are indicated by color (see Table 1). 5 Detailed Analysis of Peak Events In this section, some distinctive peak events will be presented. For each event, the output of the DETEC- TOR system is presented and discussed first. All events are prioritized as High by the DETECTOR system and are thus suspected to have a significant influence on positioning. The results are presented the same way for all events. First, a table shows the most relevant information for the event. This includes the time, the categorized type, and the power level.

7 Number of Events Power Level Figure 5: Histogram of detected interference events. Event types are indicated by color (see Table 1). Secondly, the plot generated by the DETECTOR online frontend is presented. This plot is not modified at all, but it the original DETECTOR output. Thirdly, a plot on the consequences on the GNSS reference receiver is shown for each event. This plot basically contains two graphs covering a period of time starting prior to the detected event and ending afterward. On the one hand, the carrier-to-noise value for all tracked satellites is shown. This value is color coded by the PRN number in order to distinguish between the different satellites. On the other hand, the total number of tracked satellites is plotted in black. This way, the effect of the interference on the performance of the reference receiver can be analyzed.

8 5.1 Event 1 Date Feb , 04:51:32 04:52:10 UTC Type CHIRPSAWTOOTHUP Power Rating Table 2: Characteristics of Event 1 Figure 6: DETECTOR output of Event 1 60 Carrier to Noise Ratio Number of Satellites 04:51:13 04:51:32 04:52:10 04:52:29 Figure 7: Influence on reference receiver of Event 1 This interference event has been characterized as a chirped sawtooth (up) pattern by the DETECTOR. Clearly being an event of intentional GNSS jamming, the reported power level of this event (8.4402) is the largest of all reported ones. The frequency generated by this interferer changes periodically in a sawtooth-like pattern, centered almost exactly at the L1 carrier frequency. As described before, the output of the reference receiver has been analyzed for the period of time of this event. The resulting carrier-to-noise estimates of the receiver are depicted in Figure 7 over time for all received satellites. The duration of the detected event is marked with a light red background. During this period of time, a significant drop in the carrier-to-noise values can be observed. Reduced carrier-to-noise values correspond to worse tracking performances. Due to the interference, the receiver loses the lock for up to two satellites which can thus not be used for positioning at these epochs.

9 5.2 Event 2 Date Feb , 16:16:46 16:17:26 UTC Type CDMA Power Rating Table 3: Characteristics of Event 2 Figure 8: DETECTOR output of Event 2 60 Carrier to Noise Ratio Number of Satellites 16:16:26 16:16:46 16:17:26 16:17:46 Figure 9: Influence on reference receiver of Event 2 This event, shown in Figure 8, has been characterized as CDMA-like interference. Being centered only 3 MHz off the L1 carrier frequency, this interference is rated with a power level of As shown in Figure 9, this event even has a stronger influence on the reference receiver than event 1. The number of tracked satellites reduces down to 3 for one epoch. In this case, no positioning is possible at all.

10 5.3 Event 3 Date Feb , 19:39:51 19:40:21 UTC Type VNB Power Rating Table 4: Characteristics of Event 3 Figure 10: DETECTOR output of Event 3 60 Carrier to Noise Ratio Number of Satellites 19:39:36 19:39:51 19:40:21 19:40:36 Figure 11: Influence on reference receiver of Event 3 The influence of this interference on the reference receiver is shown in Figure 11. The drop in the carrier-to-noise graphs can be seen clearly, and the tracking is lost for two satellites temporarily, lowering the number of usable satellites to a minimum of 7. This number is still sufficient for positioning, but might suffer from a degraded positioning performance.

11 5.4 Event 4 Date Feb , 06:49:56 06:50: UTC Type NB Power Rating Table 5: Characteristics of Event 4 Figure 12: DETECTOR output of Event 4 60 Carrier to Noise Ratio Number of Satellites 06:49:44 06:49:56 06:50: 06:50:32 Figure 13: Influence on reference receiver of Event 4 As shown in Figure 13, the drop in the carrier-to-noise ratios is rather small for this interference event. Thus the receiver is able to track all satellites continuously throughout this event. However, due to the degraded reception, the pseudorange accuracy might suffer from this interference, too.

12 5.5 Event 5 Date Feb , 18:26:47 18:27:23 UTC Type ST Power Rating Table 6: Characteristics of Event 5 Figure 14: DETECTOR output of Event 5 60 Carrier to Noise Ratio Number of Satellites 18:26:29 18:26:47 18:27:23 18:27:41 Figure 15: Influence on reference receiver of Event 5 Despite being rated by a power rating of just , the influence of this event on the reference receiver can be seen clearly in Figure 15. Due to the interference, the tracking is lost for up to 3 satellites, reducing the number of usable satellites to 6 temporarily.

13 5.6 Event 6 Date Feb , 10:50:45 10:51:09 UTC Type WB Power Rating Table 7: Characteristics of Event 6 Figure 16: DETECTOR output of Event 6 60 Carrier to Noise Ratio Number of Satellites 10:50:33 10:50:45 10:51:09 10:51:21 Figure 17: Influence on reference receiver of Event 6 This wide-band interference event is centered approximately 1 MHz off the GPS L1 carrier frequency (see Figure 16). It has been rated by the DETECTOR system with a power level of and tagged as a high priority event. The influence of this event on the reference receiver is shown in Figure 17. The tracking is lost for up to 4 satellites due to the interference, leaving just 5 satellites for positioning. The positioning performance is degraded heavily under these conditions.

14 6 Interpretation The number and characterization of the detected events clearly show that the RFI threat is real for German motorways, too. During the test campaign, up to 8 severe interference events which can influence the availability of satellite navigation severely (i.e. medium and high priority) have been detected per day. Out of the 34 high priority events, most were Narrow Band (NB, 14 events) or Very Narrow Band (VNB, 9) events. The chirped sawtooth jamming signal was observed four times on different days. Of the 16 interference types distinguishable by the DETECTOR system, 9 different types have been detected over the testing period. This proves that jamming has become a real threat for high-performance GNSS applications, especially in scenarios like the one presented here. Due to the different types of interference detected, at least some of these have to be classified as intentional jamming. This implies the (illegal) use of personal privacy devices (PPDs). So far, little is known about the different sources causing the observed types of interference. Systematic monitoring and detection have just started short time ago, so the research in this area is still ongoing. The professional-grade reference receiver used to characterize the real influence of the detected events was clearly affected by the interference events, too. This reference receiver was connected to a choke-ring antenna in close vicinity to the DETECTOR measurement antenna. Due to the design of choke-ring antennas, RFI sources at negative or low elevations are attenuated quite effectively. With other types of GNSS antennas, setups with RFI events at higher elevations, or less-advanced GNSS receivers, the GNSS positioning quality could be degraded even more by interference effects. Especially for safety critical GNSS applications, these results show that interference events can be a real threat for safe operations with regard to accuracy, availability, continuity and integrity. However, this field test could only give a first impression for a single location. In order to generate a clearer overall picture of this threat, monitoring campaigns over longer periods of time at multiple locations will be neccessary. 7 Countermeasures There are several technical solutions for addressing the problem of jamming and limiting its consequences. Most interference sources are ground based (e.g. vehicles on the motorway carrying a Personal Privacy Devices), so some mechanical countermeasures can be taken.[6] Possible countermeasures include the use of choke ring antennas, changing the altitude of the antenna, keeping the antenna away from possible sources of interference[15], or building obstacles between the GNSS antennas and the sources of interference[3]. An obstacle in the line of sight of the antenna to the jammer can prevent the jamming signals from reaching the GNSS antenna. Such a wall is one of the measures taken to improve the robustness against interference at the GBAS installation at Newark airport.[3] However, the locations of multipath-limiting antennas used by GBAS ground installations have to be selected very carefully due to their influence on the overall performance. Thus this countermeasure is not always possible, especially for complex airports with limited space. Choke rings around GNSS antennas are primarily designed to block multipath signals reflected from the ground. Even though they can reduce the received signal level for low-elevation interferers, the results showed above clearly indicate that this is only partly effective. These mechanical measures will not work if the interference is emitted at higher elevations (e.g. by high transmission towers or if the jamming transmitter is airborne). Alternatively one of the following solutions can be used: adaptive notch filtering, switching received GNSS frequency to L2 or E5, adding INS (inertial navigation system) sensors, then combining GPS and

15 INS, adding eloran or an adaptive antenna arrays to achieve adaptive beamforming (known as CRPA Controlled Reception antenna pattern). [6, 9] One possibility for rapid detection of a jamming or spoofing source is monitoring the GNSS receivers AGC (Automatic Gain Control) gain value [1]. The AGC gain decreases a lot in the presence of a jammer or spoofer, because a jammer adds more GPS signal power, so less gain is required to obtain the same RF signal power level inside the receiver. The AGC s gain change can be detected, when the baseline of the AGC gain is known, that is when it has been measured and calibrated over several days before operation.[1] AGC monitoring is computationally inexpensive and allows detecting both spoofing and jamming. Field tests in Sweden have shown the feasibility of this approach.[1] Cutting out the jam signal with a filter eliminates the part of the signal containing the jamming signal. It works, because the GPS and other GNSS signals are broadband. So taking away a little part of the signal is possible, but this implies that the jamming signal is narrow band. If it is broadband as well, large parts of the GPS signal get cut out together with the jamming signal in the filtering process, which defeats the object. Several personal privacy devices have transmitted broadband signals at Newark.[4] Jamming can also be mitigated at the algorithmic level inside the receiver by using advanced signal acquisition methods such as vector forming[3, 13] and direct positioning.[3, 10] Vector based tracking loops combine the two tasks of signal tracking and position/velocity estimation into one algorithm. In contrast traditional or scalar tracking methods track each satellite s signal(s) independently; both of each other and of the position/velocity solution. [13] The advantages of this method are lowering the minimum carrier-to-noise ratio, at which the receiver can operate, the ability to bridge signal outages, the ability to constrain the receivers motion in one or two directions. The primary drawbacks of vector tracking loops [...] are their processing load and complexity. [13] Direct Positioning tracks the underlying signal and navigation state parameter set of receiver position, clock bias, velocity and clock drift directly from the received raw GPS signal. [10] This improves robustness against jamming attacks and maintains position fixes when normal receivers stop positioning. One of the best methods in our opinion is the use of beam-forming and null-steering antennas CRPA antennas. Adaptive beam-forming uses an antenna array CRPA (Controlled Reception Pattern Antenna) and a sophisticated processing algorithm. It is a very good method to focus the receiver s reception direction towards the satellites and to eliminate reception in the direction of the interference source (sidelobe cancellation). It is complex, computationally expensive and requires special antennas. [5] The main advantage is the possibility to solely use signals arriving from the satellites and to exclude all other signals arriving from anywhere else. This way it would be very difficult to jam a receiver with such a sophisticated CRPA antenna array and algorithm. Combining GPS with inertial sensors, which consist of accelerometers and gyroscopes measuring movement, produces a robust and powerful system, but works only if the jamming is confined to short periods of time. In the longer term the INS part drifts too much, accumulates errors and the position accuracy gets worse and worse beyond the acceptable limit. Also INS does not make sense for stationary receivers like airport GPS and WAAS reference stations, due to lack of acceleration. [6] Many other additional sensors have been suggested and tested, in recent years. A radio navigation backup system could be eloran, the successor of the previously wide-spread maritime LORAN (long-range navigation) system. Compared to GNSS, enhanced LORAN (eloran) is broadcast on lower frequencies and at a significantly higher signal strength in order to enable hyperbolic positioning. There are several countries with eloran installations. Unfortunately, the US has discontinued the use of LORAN a few years ago and started to dismantle many of the LORAN stations (which could have been upgraded to eloran easily). The UK on the other hand has run several successful trials with eloran and is currently building up a coastal network with 7 eloran stations. The initial operational capability was achieved in 14.[8] In addition to the countermeasures and backup systems presented before, we would like to recommend a long-term, spatially widespread monitoring and detection campaign of jamming events in Germany. This is the only way to get a statistically significant, clear picture of the extent and the impact of GNSS interference.

16 8 Conclusion In this study we have reported the results of a two week field test in early 16 near Braunschweig. We were able to install a novel detection system to monitor the GPS L1 jamming events near a German motorway and airport. We detected several hundred interference events, about 14% of them were high priority, high signal power events with a clear impact on a high grade GNSS receiver. For the protection of safety critical aviation, land traffic operations and critical infrastructure we recommend a more systematic study and technical countermeasures. A long-term study should be carried out at different locations around Germany for several months, in order to gain a clear insight and overview into GNSS reception and jamming situation, possibly together with an effort to locate and inactivate high signal power jammer sources. In addition technical measures need to be used, enabling high grade GNSS positioning, navigation and timing to overcome and withstand such interference, either by excluding the jamming signals mechanically (wall) or electronically (CRPA antennas) or by adding completely independent reliable backup systems, such as atomic clocks for timing applications or eloran for navigation applications. Acknowledgement The authors would like to thank Guy Buesnel from Spirent Communications for his helpful comments. References [1] Holly Borowski et al. Detecting False Signals with Automatic Gain Control. In: GPS World (Apr. 12). [2] Guy Buesnel and Okko Bleeker. Interference Resistance in Modern GNSS Receivers. Presentation at Celebrating 140 years The Institution of Engineering and Technology. 11. [3] Guy Buesnel, Rick Hamilton, and Grace Gao. Noises Off: Interference and Mitigation Techniques. May 16. [4] Joseph C. Grabowski. Personal Privacy Jammers: Locating Jersey PPDs Jamming GBAS Safetyof-Life Signals. In: GPS World (Apr. 12). [5] Achim Hornbostel et al. Simulation of Multi-Element Antenna Systems for Navigation Applications. In: IEEE Systems Journal 2.1 (Mar. 08), pp issn: doi: /JSYST [6] Karen von Hünerbein and Werner Lange. Global Satellite Navigation: New Trends, Highlights and Risks. In: Proceedings of the European Telemetry and Test Conference. June 12. [7] Karen von Hünerbein and Werner Lange. Real Life Evidence for Spoofing and Jamming of GNSS Receivers. In: International Symposium on Certification of GNSS Systems & Services (CERGAL). July 15. [8] InsideGNSS. UK eloran Now in Operation to Back Up GPS Oct. 14. [9] Michael Jones. The Civilian Battlefield Protecting GNSS Receivers from Interference and Jamming. In: Inside GNSS March / April (11). [10] Yuting Ng and Grace Gao. Mitigating Jamming and Meaconing Attacks Using Direct GPS Positioning. In: 16 IEEE/ION Position, Location and Navigation Symposium (PLANS). Apr. 16, pp doi: /PLANS [11] Truong Nguyen. Evaluation of a Mobile Phone for Aircraft GPS Interference. Tech. rep. 04. [12] Niedersächsische Landesbehörde für Straßenbau und Verkehr. Verkehrsmengenkarte Niedersachsen. 10.

17 [13] Mark Petovello, Matthew Lashley, and David Bevley. What are vector tracking loops and what are their benefits and drawbacks? In: Inside GNSS May / June (09). [14] Martin Pölöskey, Carsten Hoelper, and Kevin Sheridan. Detektion von Störungen satellitenbasierter Navigations- und Fahrerassistenzsysteme durch GPS- oder Galileo-Jammer. In: POSNAV ITS. 13. [15] Sam Pullen and Grace Gao. GNSS Jamming in the Name of Privacy Potential Threat to GPS Aviation. In: Inside GNSS March / April (12). [16] Alexander Rügamer and Dirk Kowalewski. Jamming and Spoofing of GNSS Signals An Underestimated Risk?! In: Proceedings of the FIG Working Week 15. May 15. [17] Logan Scott. Protecting Position in Critical Operations. In: GPS World (May 15). [18] Spirent. GSS100D GNSS Interference Detector Datasheet with Product Description. Sept. 15.