Over-reliance on GPS poses security risk, warn experts

Researchers from the Royal Academy of Engineering have warned that an over-reliance on Global Positioning Systems could lead to a breakdown in critical UK systems, if they are interrupted by man-made or natural interference.

The Royal of Academy of Engineers has warned against over-reliance on GPS, which will soon be supplemented by the Galileo satellite system. Photo credit: ESA/J Huart

As well as being commonplace in smartphones and other consumer technology, global satellite radio navigation systems such as Global Positioning Systems (GPS) are used in a variety of other platforms. They have non-critical uses, such as for tracking haulage and deliveries, and critical applications, such as in financial institutions and for emergency services.

"GPS and other Global Navigation Space Systems (GNSS) are so useful and so cheap to build into equipment that we have become almost blindly reliant on the data they give us," Martyn Thomas, chairman of the academy's GNSS working group, said in a statement on Tuesday. "A significant failure of GPS could cause lots of services to fail at the same time, including many that are thought to be completely independent of each other."

GPS signals can be easily affected by natural events, such as solar flares, or by deliberate interference from devices such as GPS jammers. The researchers pointed out two factors that enhance the interference risk: first, jamming technology is freely available to buy as the result of a legal loophole; and second, GPS relies on a relatively weak signal sent from up to 12,000 miles away.

The report warns that many key infrastructure systems are potentially vulnerable to attack. For example, GPS technology is used widely in financial institutions that need transaction time stamps that are accurate to thousandths or even millionths of a second.

As opportunities arise for criminals to make money, avoid costs or avoid detection, it is known that significant effort will be directed towards attacking GNSS-based systems.

– Royal Academy of Engineering report

"As opportunities arise for criminals to make money, avoid costs or avoid detection, it is known that significant effort will be directed towards attacking GNSS-based systems," the report said.

In one scenario described by the researchers, criminals could jam GNSS-based tracking of a vehicle to evade road user charges or to stop supervisors from following the driver's movements. Other examples were rebroadcasting a GNSS signal to misreport a position and spoofing a signal to deceive a tracking device.

In a review of the European satellite radio navigation programmes on 18 January, the European Commission estimated that an "€800bn (£688.6bn) chunk" of the region's economy is dependent on GNSS, the report noted.

In addition, the researchers said that minor inaccuracies in the reporting of GPS locations often pose a more significant risk than major failures that would lead to a switch to backup systems.

"The severity of the errors may be so large as to give noticeably suspect results which can immediately be identified by the users, but the real threat lies in dangerously misleading results which may not seem obviously wrong — a ship directed slightly off course by faulty data could steer it into danger," the academy warned.

Mitigate the risk

The risk can be mitigated in the short term by the use of hold-over clocks that can accurately keep time, said Bob Cockshott, director of the Digital Systems Knowledge Transfer Network.

In the long term, the introduction of an independent technology, such as a Positioning, Navigation and Timing (PNT) system, would help, he added. In the UK, work is being carried out on a land-based system called eLoran, which can act as a complementary backup for GNSS systems.

"It [eLoran] is high-power, low frequency and can penetrate buildings much more effectively [than GPS]. GPS is more effective if the right backup system is in place," Cockshott told ZDNet UK.

Another move that would mitigate the risk, according to the Royal Academy of Engineering, would be to close the loophole that allows the import, advertisement and possession of GPS-jamming equipment.

The EU is building the Galileo satellite system, which is intended as an alternative to the US-controlled GPS constellation for providing geolocation services for emergency and critical systems. Galileo will use an encrypted signal in an attempt to thwart threats to infrastructure. However, Thomas said that while Galileo will help improve the situation, it is not a fix.

"The deployment of Europe's Galileo system will greatly improve the resilience of the combined GPS/Galileo system, but many of the vulnerabilities we have identified in this report will remain," he said. "No one has a complete picture of the many ways in which we have become dependent on weak signals 12,000 miles above us."