Understanding and Mitigating Global Positioning System (GPS) Vulnerabilities Issue: Increasing US military dependence on GPS may lead to a single point of failure if vulnerabilities are not understood and mitigated. Background: Since the late 1980s, the US military has become increasingly reliant on GPS technology to provide accurate position solutions for a wide variety of missions. The following examples of military GPS use were noted in Appendix B of a 1995 RAND report titled The Global Positioning System: Assessing National Policies: 1987-1988 The Navy used GPS to determine the position of minefields in the Persian Gulf. 1989 Operation Just Cause: The Air Force used GPS to overcome inaccurate maps showing key bridges in the wrong position. 1990-1991 Persian Gulf Crisis/Operation Desert Storm: GPS is tested under combat conditions for the first time and is credited with revolutionizing ground combat operations. 1993 Operation Restore Hope: US forces used GPS to overcome the lack of accurate maps and ground-based navigation facilities when air dropping food and supplies to remote areas. 1995 Balkan crisis: Air Force transport planes used GPS to accurately drop food and medicine at night. (Although not noted in the RAND report GPS was also essential to the rescue of Air Force F-16 pilot Captain Scott O Grady.) More recently in Afghanistan and Iraq, the use of GPS-based Joint Direct Attack Munition (JDAM) guidance kits allowed for the accurate placement of otherwise dumb unguided free-fall bombs. Unfortunately, despite these successes, inappropriate use of GPS may have played a role in the March 23, 2003 attack on the US Army s 507 th Maintenance Company at An Nasiriyah that killed 11 soldiers and wounded nine. A special fact-finding report released by the Army outlines the events surrounding the attack. It mentions that the company commander relied primarily on his [commercial-use but Army-issued] GPS and an annotated theater-standard map on which he had erroneously marked the wrong route ( Attack 4). While we can only speculate about what actually caused the 18-vehicle convoy to miss a critical left turn it seems reasonable that over-reliance on GPS was likely a root cause. Was the GPS signal degraded or being jammed, causing erroneous indications? Was the company commander too confident in GPS, causing him to disregard his map? Was the company commander properly trained in map reading and navigation? Did the 507 th receive the appropriate type and number of maps and enough mission-planning information that a reasonable person could be expected to figure out what route to take? Why didn t any of the 32 other people in the convoy notice the navigation error and, if they did notice why didn t they say anything? These are some of the questions raised by this specific incident but they serve as a warning to all GPS users: like any system, GPS is vulnerable to physical and administrative limitations. We must implement backup systems and train users to recognize when and how to operate those systems so we are not paralyzed in the event GPS usability is adversely affected. 1
Discussion: Like any space-based system, GPS is limited by the laws of physics. These laws not only determine the placement of satellites in orbit, but also describe how outside forces interact with the GPS signal over the course of its journey to Earth. GPS satellites broadcast their information on L- band UHF frequencies, which are susceptible to intentional and unintentional interference. Sources of intentional interference include jamming, spoofing, and meaconing. Unintentional disruption can be attributed to the space environment, radio frequency interference, and human factors. Physical damage to GPS satellites and/or their ground-based tracking and control stations can be intentional (e.g., enemy attack) or unintentional (e.g., earthquake, fire, flood, etc.). Many of these vulnerabilities can be mitigated by a variety of strategies. See Attachment 1 for further information. In addition to physical vulnerabilities, GPS is also subject to budget constraints, international competition from similar systems including the Russian Global Navigation Satellite System (GLONASS) and the European Union s proposed Galileo system, and increasing usage by the civilian and commercial sectors. While these administrative considerations are not necessarily vulnerabilities they must be taken into account when planning missions because they may impose artificial (i.e., not physical) limitations on US military use of GPS. See attachment 2 for further information. Currently there is not a US-based worldwide alternative navigation system that matches the abilities of GPS. Aircraft can still use other navigation aids such as TACAN, VOR/DME, ILS, and LORAN- C as backups when within range of the appropriate transmitters. Many of these systems, however, are going to be phased out beginning in 2010, and ground and maritime users can only use LORAN-C due to the line-of-sight requirements of TACAN, VOR/DME, and ILS. In the future, US users may be able to use the European Union s proposed Galileo system as a backup. Combination GPS/inertial navigation systems are being introduced to the fleet and provide short-term backup navigation solutions in the event the GPS signal is lost. See attachment 3 for further information. Recommendations: Implement a DoD-wide training program to ensure US military personnel who rely on GPS are familiar with the basic operation, capabilities, and vulnerabilities of the system. Ensure adequate funding is maintained for GPS research and satellite maintenance and upgrade programs to keep the system healthy and robust. 2
Attachment 1: Physical Vulnerabilities GPS system basics: GPS consists of three separate elements: the space segment (i.e., satellites), the control segment (i.e., ground stations), and the user segment (i.e., receivers). The space segment consists of 24 satellites in six different orbital planes with four satellites in each plane. Each satellite operates in a circular 20,200 km orbit with a 12-hour period and follows a repeating ground track, passing over the same spot on Earth once per day. GPS provides a standard positioning service (SPS) for general use and a precise positioning service (PPS) for military use. Each satellite broadcasts two codes: the coarse acquisition (C/A) code for use with SPS and the precision (P) code for use with PPS. The L1 frequency (1575.42 MHz) broadcasts both the C/A and P code and the L2 frequency (1227.6 MHz) broadcasts only the P code. In the future, L2 and a new frequency designated L5 (1176.45 MHz) will also carry the C/A code (FRP 1 2-2). The satellites currently in orbit are designed to provide reliable service over a 7.5-10 year design life (GPSSPSPS 2 2). The GPS control segment consists of a master control station (MCS), a backup master control station, six monitor stations, and four ground antennas. The locations of the monitor stations are known to a high degree of accuracy and each station is equipped with an atomic clock. When the monitor stations receive GPS signals from space they compute a reverse position solution for each satellite they hold in contact. This near real-time information is passed to the MCS where it is processed to determine each satellite s timing and ephemeris errors. The ground antennas provide a near real-time telemetry, tracking, and commanding interface between the satellites and the MCS and are used to monitor the health of the space segment, upload navigation data, and detect and respond to service failures. The user segment includes GPS receivers and associated equipment such as antennas. When a user receives GPS signals from space, timing information contained within the signals is used to triangulate the receiver s position. A user must receive signals from a minimum of four different satellites in order to accurately determine its position. The GPS satellite constellation was designed so that a minimum of five satellites are visible to a user at any time, worldwide (Pace et al. 218). Jamming: Jamming is defined as the deliberate emission of radio frequency energy of sufficient power and with the proper characteristics to prevent receivers in the target area from tracking the GPS signals (Volpe 3 30). Research has shown that an airborne low power jammer (1 watt) can jam a significant area. Depending on the sophistication of the jammer the affected area can range from 10 km to over 620 miles (Volpe 30-31). The jamming threat can be mitigated by using multiple frequencies to 1 FRP refers to the US Department of Defense and US Department of Transportation s 2001 Federal Radionavigation Plan. 2 GPSSPSPS refers to the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence s October, 2001 report titled Global Positioning System Standard Positioning Service Performance Standard. 3 Volpe refers to the John A. Volpe National Transportation Systems Center 29 August 2001 report titled Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System. 3
carry the GPS signal, incorporating spatial, temporal, and spectral signal processing, and adding additional sensors to the receiver (Volpe 36). Spoofing: The intent of spoofing is to cause an active GPS receiver to lock onto legitimateappearing false signals and then be slowly walked off the desired path such that sufficient time passes prior to the discovery of the deception, thereby precluding satisfactory corrective measures (Volpe 33). Spoofing can be more difficult to achieve than jamming and is less likely to be used since spoofing is typically targeted at a specific user, however, the minimum spoofing effect would be to jam receivers in the area. To mitigate the vulnerability to spoofing, military receivers, when properly keyed, are equipped to receive an encrypted version of the P code known as the Y code. Meaconing: Meaconing is defined as the reception, delay, and rebroadcast of radionavigation signals to confuse a navigation system or user (Volpe 33). Meaconing is easier to achieve than spoofing because legitimate-appearing signals do not have to be generated. To be effective the meaconing source must place itself between the satellites and the receiver (i.e., airborne) in order to intercept and delay the arriving signals. User vigilance and the proper use of adequate charts and maps are the best mitigation strategy. Total reliance on a meaconed GPS signal can lead to hazardous navigation errors. Physical damage: Physical damage to satellites and ground stations has the potential to cause long-term outages or significant disruptions of GPS service. The nominal timeline for replacement of a failed satellite is 30 days given an available on-orbit spare or 120 days when a launch is necessary (GPSSPSPS A-10). The government s intent is to allow the GPS constellation to contain no fewer than 22 healthy satellites in primary orbits at any time but space weapons or a collision with a piece of debris could incapacitate more than two satellites at any given time. Damage to or destruction of ground control stations could also severely impact the health and usability of the GPS system. Hardening satellites against weapons such as lasers and collisions and protecting ground stations from attack and natural disasters will help mitigate this vulnerability. Space environment: The F layer of the ionosphere (approximately 350 km above the Earth) can refract GPS signals, causing timing errors that result in inaccurate triangulation calculations. Solar flare activity can also have a similarly negative effect. A dual-frequency receiver (one that processes L2 or L5 in addition to L1) can virtually eliminate this type of error. Radio frequency (RF) interference: RF transmitters such as VHF, TV channels 23, 66, and 67, the Mobile Satellite Service, Ultra Wideband communications, over-the-horizon radar, and personal electronics such as cell phones may interfere with the L1 signal. L2 may experience more interference since it is in a band where radar systems have co-primary allocation. L5 shares co-primary allocation with the Joint Tactical Information Distribution System and the Multi-functional Information Distribution System. Both L1 and L5 are allocated to the Aeronautical Radionavigation Service. RF interference is essentially unintentional jamming and can be guarded against by using multiple frequencies, increasing the satellite signal power, and incorporating jam-resistant technology (see section on jamming) into receivers. 4
Human factors: According to the Volpe report, most of the accidents to date involving use of GPS have been traced to human factors (28). Studies have shown that people, especially pilots, are more willing to take larger risks when using GPS compared to older navigation systems. A recent US government spoofing test showed that even users expecting GPS problems can put too much (or too little) faith in the receiver solution (Volpe 68). Human error in satellite and receiver design has also caused problems in the past. Training, user vigilance, and the appropriate use of available backup navigation solutions is key. 5
Attachment 2: Administrative Concerns Budget: The 2001 Federal Radionavigation Plan shows the phase-out of navigation aids such as TACAN, VOR/DME, and ILS to begin in calendar year 2010 with a shift to GPS technologies as the sole basis of federally supported navigation (3-2). To help mitigate the various physical vulnerabilities discussed in attachment 1 the GPS modernization plan, a multi-phase effort to be executed over the next 15+ years, focuses on improving position and timing accuracy, availability, integrity monitoring support capability and enhancement to the control system (FRP 3-3). In order to ensure the improvements necessary for the safe navigation of air, land, and sea vehicles, both civilian and military, are made and adequately supported we must ensure the GPS program receives an appropriate amount of funding. International competition: Russia has developed and implemented its own version of a satellite-based global navigation system called GLONASS (Global Navigation Satellite System). Its satellites occupy different orbits and transmit timing information on different frequencies than GPS. The European Union has also expressed interest in developing its own satellite-based navigation system called Galileo. The US Department of State issued a press release on 7 March 2002 stating its desire for cooperation with the EU to ensure Galileo is interoperable with GPS. Without formal agreements relating to issues such as radio frequency spectrum management Galileo and GPS could encounter problems with mutual interference, decreasing the reliability, availability, and usability of both systems. Obviously, Galileo and GLONASS should also have similar agreements. Increasing usage by civilians: Since President Reagan offered to make GPS available for use by civilian aircraft following the September 1983 Soviet downing of Korean Air flight 007 GPS technology has slowly spread into the civilian world. Following President Clinton s 1 May 2000 announcement that selective availability (SA) the intentional degradation of publicly available GPS signals would be turned off there has been an explosion in the number and variety of commercially available GPS devices. GPS-equipped cars, watches, two-way radios and personal digital assistants are now commonplace. In addition to its obvious applicability to navigation GPS has quickly become a critical part of many telecommunications networks that require precise timing and synchronization. The increase in civilian use and reliance on GPS will likely help secure funding for planned upgrades to the GPS system, but also has the potential to become an Achilles heel. 6
Attachment 3: Alternatives to GPS Older technologies: Although they are currently scheduled to be phased out beginning in 2010 the FAA will continue to operate about 50% of the currently available ground-based aviation navigational aids (VOR/DME, TACAN, ILS, MLS, NDB). This minimum operational network will support en route and terminal operations at busier airports within the national airspace in the event of a GPS disruption. Although not currently planned, a further reduction to a basic backup network 25% of the currently available navaids is possible (FRP 3-9). This reduction may have an impact on US pilot and navigator training in the event of a long term GPS outage. LORAN-C provides for maritime navigation in US coastal areas and navigation, location, and timing services for both civil and military air, land, and sea assets throughout the continental US, their coastal areas, and parts of Alaska. LORAN-C is also supported by the Canadian airspace system. At this time the US government will continue to operate its LORAN-C system while evaluating the long-term need for continued operation. Galileo: Although the European Union s proposed Galileo system is currently in the planning stages and not likely to begin nominal operation until 2008 it could be used as a future backup satellite navigation service as long as the proper political and scientific (i.e., frequency management) agreements are in place (Volpe 53). Different satellite constellations have been under consideration and at this time it appears that Galileo will consist of 30 medium earth orbit (MEO) satellites, 27 of which will be in a 3- plane symmetrical Walker configuration with 3 on-orbit spare satellites (Volpe 53). Galileo would undoubtedly be susceptible to some of the same vulnerabilities as GPS since the principle of operation remains the same but due to the differing orbits the likelihood of both systems becoming totally incapacitated at the same time is relatively low. GPS/inertial systems: According to the Volpe report, GPS and inertial systems have complementary error sources. GPS provides excellent long-tem stability whereas inertial sensors have good short-term stability, but drift without limit over time (53). Another benefit of inertial sensors is that they are self-contained so they are not susceptible to RF interference. Although GPS/inertial systems still rely on GPS, combining the two systems helps reduce vulnerabilities in two ways. First, the inertial sensor allows the user to sense its own changes in motion and it does not have to rely on GPS to try to guess or predict what changes are occurring. The effect is to reduce the required bandwidth of antenna elements, which in turn reduces the system s sensitivity to RF noise and interference. The second benefit is that the inertial system allows the user to coast for a short period in the event the GPS signal is lost. Navigation-grade inertial systems are expensive ($15,000 - $18,000 per gyro) but have drift rates of less than 1 nm/hour, which is within the aviation standard of 2 nm/hour. Cheaper gyros with drift rates of several tens of degrees per hour cost about $1,000 - $2,000. GPS/inertial systems are already being incorporated into newer fleet aircraft such as the Navy s MH-60S helicopter. 7
Bibliography Assistant Secretary of Defense for Command, Control, Communications, and Intelligence. Global Positioning System Standard Positioning Service Performance Standard. October, 2001. This document defines the levels of performance the US government makes available to civil users through the GPS Standard Positioning Service (SPS). John A. Volpe National Transportation Systems Center. Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System. US Department of Transportation, 29 August 2001. This report examines the potential vulnerabilities of GPS as they apply to civilian users. It is applicable to military GPS users as well since most military GPS receivers must pick up the civilian GPS signal before locking on to the military GPS signal. Pace, Scott, et al. The Global Positioning System: Assessing National Policies. RAND, 1995. This RAND report is an in-depth discussion of many aspects of GPS. It identifies the major GPS policy issues, highlights opportunities and vulnerabilities in the defense, commercial, and foreignpolicy arenas, discusses their implications for alternative governance and funding arrangements, and makes recommendations for US policy. US Army. Attack on the 507 th Maintenance Company. http://www.army.mil/features/507thmaintcmpy/attackonthe507maintcmpy.pdf. Accessed 13 December 2003. This special fact-finding report describes the attack on an element of the US Army s 507 th Maintenance Company in the city of An Nasiriyah on 23 March 2003 during Operation Iraqi Freedom. It presents but does not assess decisions made and actions taken. US Army. SATCOM 101. April 2000. Excerpts from this publication were included on the SS3011 course CD. They discuss basic principles of the space environment and satellite communications. US Department of Defense and US Department of Transportation. 2001 Federal Radionavigation Plan. DOD-4650.5/DOT-VNTSC-RSPA-01-3. This report is the official source of radionavigation policy and planning for the US government. It is prepared jointly by the Departments of Defense and Transportation and covers radionavigation systems used by both civilian and military personnel. 8
US Department of State Office of the Spokesman. US Global Positioning System and European Galileo System. 7 March 2002. http://www.state.gov/r/pa/prs/ps/2003/8673.htm. Accessed 13 December 2003. White House Office of the Press Secretary. Statement by the President Regarding the United States Decision to Stop Degrading Global Positioning System Accuracy. 1 May 2000. http://www.ostp.gov/html/0053_2.html. Accessed 13 December 2003. 9