Integrity, jamming and spoofing

On a Tuesday in October, every RTK rover on the canal job lost its fix at the same moment. The base receiver near the highway showed C/N0 values ten to fifteen decibels below normal on every satellite, and the rovers within a kilometer of the highway could not track at all. Twenty minutes later everything returned to normal. Ruth Albrecht recognized the signature: a vehicle on the highway carrying a GNSS jammer, illegal but cheap, probably fitted by a driver who did not want a fleet tracker to report his position. The incident prompted the last topic of the course. GNSS signals are weak and openly specified, so they can be drowned out or imitated, and a surveyor, engineer or system designer must know how to tell when positions cannot be trusted and what to do about it.

What integrity means

Four measures describe the performance of a navigation system. Accuracy is how close positions are to the truth, usually stated at 95 %. Integrity is the ability of the system to warn users within a specified time when it should not be used. Continuity is the probability that the service, once started, continues without interruption through an operation such as an aircraft approach. Availability is the fraction of time that the service meets all the other requirements. For aviation, integrity is expressed with three quantities: the alert limit, the largest error that can be tolerated for an operation; the time to alert; and the integrity risk, the probability that the error exceeds the alert limit without an alert, typically of order \(10^{-7}\) per approach. The receiver or augmentation system computes a protection level, a bound on the position error that holds with that probability; if the protection level exceeds the alert limit, the operation is not available.

Surveyors rarely compute protection levels, but the same idea runs through survey quality control. Redundant observations, independent checks, statistical tests on residuals and repeat measurements are how a survey protects its users against a measurement that is wrong without looking wrong. The methods of this lesson apply equally to a pseudorange solution, an RTK fix and a network adjustment.

Receiver autonomous integrity monitoring

RAIM checks the consistency of the measurements within a single receiver. With more satellites than unknowns, the least-squares solution has residuals, and if all measurements are good, the weighted sum of squared residuals follows a chi-square distribution with \(n - 4\) degrees of freedom for a single-system solution. A fault in one pseudorange inflates the sum. The detection test compares

where \(P_{fa}\) is the chosen false-alarm probability. With five satellites a fault can be detected but not identified; with six or more it can usually be excluded by repeating the test on each subset with one satellite removed, a process called fault detection and exclusion (FDE). A least-squares solution spreads a fault over all residuals, so the largest residual does not always belong to the faulty satellite; testing the subsets is more reliable. Advanced RAIM (ARAIM), now being developed for aviation, extends the idea to multiple constellations and to the possibility of faults affecting a whole constellation at once.

The program below takes the eight-satellite geometry of Lesson 4, adds a 25 m fault to the fourth pseudorange, and runs detection and exclusion. It then shows a simple interference check based on the C/N0 of all tracked satellites.

# Receiver autonomous integrity monitoring (RAIM): detect and exclude a faulty range, and watch C/N0
import math, random
random.seed(7)

def ecef(lat, lon, h, a=6378137.0, f=1 / 298.257222101):
    e2 = f * (2 - f); la, lo = math.radians(lat), math.radians(lon)
    N = a / math.sqrt(1 - e2 * math.sin(la) ** 2)
    return [(N + h) * math.cos(la) * math.cos(lo), (N + h) * math.cos(la) * math.sin(lo), (N * (1 - e2) + h) * math.sin(la)]

def enu_rows(lat, lon):
    la, lo = math.radians(lat), math.radians(lon)
    return [[-math.sin(lo), math.cos(lo), 0.0],
            [-math.sin(la) * math.cos(lo), -math.sin(la) * math.sin(lo), math.cos(la)],
            [math.cos(la) * math.cos(lo), math.cos(la) * math.sin(lo), math.sin(la)]]

LAT, LON, H = 47.5060042, -111.2977909, 1004.826         # pillar CR1
truth = ecef(LAT, LON, H); R = enu_rows(LAT, LON)
c = 299792458.0; clock = 1.25e-4                         # receiver clock 125 microseconds fast

# Satellites placed at the given azimuth and elevation on a 26 560 km orbit sphere
sky = [(15, 72), (68, 34), (122, 18), (171, 49), (215, 26), (262, 61), (301, 14), (340, 38)]
sats = []
for az, el in sky:
    a, e = math.radians(az), math.radians(el)
    u_enu = [math.cos(e) * math.sin(a), math.cos(e) * math.cos(a), math.sin(e)]
    u = [sum(R[k][i] * u_enu[k] for k in range(3)) for i in range(3)]       # ENU to ECEF
    b = sum(ui * ti for ui, ti in zip(u, truth)); r2 = sum(t * t for t in truth)
    rho = -b + math.sqrt(b * b - r2 + 26560e3 ** 2)
    sats.append([t + rho * ui for t, ui in zip(truth, u)])
SIGMA = 1.5
P = [math.dist(s, truth) + c * clock + random.gauss(0, SIGMA) for s in sats]
P[3] += 25.0                                             # a 25 m fault on the fourth satellite

def solve(A, y):   # normal equations by Gaussian elimination
    n = len(A[0]); N = [[sum(A[k][i] * A[k][j] for k in range(len(A))) for j in range(n)] for i in range(n)]
    u = [sum(A[k][i] * y[k] for k in range(len(A))) for i in range(n)]
    M = [N[i] + [u[i]] + [1.0 if i == j else 0.0 for j in range(n)] for i in range(n)]
    for col in range(n):
        p = max(range(col, n), key=lambda r: abs(M[r][col])); M[col], M[p] = M[p], M[col]
        d = M[col][col]; M[col] = [v / d for v in M[col]]
        for r in range(n):
            if r != col:
                f = M[r][col]; M[r] = [a - f * b for a, b in zip(M[r], M[col])]
    return [M[i][n] for i in range(n)], [row[n + 1:] for row in M]

def lsq(idx):
    x = [0.0, 0.0, 0.0, 0.0]
    for _ in range(10):
        A, w = [], []
        for i in idx:
            rho = math.dist(sats[i], x[:3])
            A.append([(x[k] - sats[i][k]) / rho for k in range(3)] + [1.0]); w.append(P[i] - (rho + x[3]))
        dx, Q = solve(A, w); x = [a + b for a, b in zip(x, dx)]
    res = [P[i] - (math.dist(sats[i], x[:3]) + x[3]) for i in idx]
    d = [a - b for a, b in zip(x[:3], truth)]
    err_h = math.hypot(sum(R[0][i] * d[i] for i in range(3)), sum(R[1][i] * d[i] for i in range(3)))
    err_v = sum(R[2][i] * d[i] for i in range(3))
    return sum((r / SIGMA) ** 2 for r in res), res, err_h, err_v

THRESH = {4: 18.47, 3: 16.27}            # chi-square thresholds for a false-alarm probability of 0.001
allsat = list(range(len(sats)))
T_all, res, eh, ev = lsq(allsat)
print("all", len(allsat), "satellites: test statistic", round(T_all, 1), "threshold", THRESH[len(allsat) - 4],
      "-> fault detected" if T_all > THRESH[len(allsat) - 4] else "-> consistent")
print("  residuals (m):", ", ".join(format(r, "+.1f") for r in res), "  horizontal error", round(eh, 2), "m, vertical", round(ev, 2), "m")
for drop in allsat:                      # exclusion: try every subset with one satellite removed
    sub = [i for i in allsat if i != drop]
    Ts, _, eh, ev = lsq(sub)
    flag = "consistent" if Ts < THRESH[len(sub) - 4] else "fault remains"
    print("  without satellite", drop + 1, ": statistic", format(Ts, "5.1f"), flag.ljust(13), "errors H", format(eh, "5.2f"), "V", format(ev, "6.2f"), "m")

# Interference monitoring: C/N0 of all tracked satellites drops together when a jammer is near
normal = [46, 44, 39, 45, 41, 47, 37, 43]
now = [33, 31, 27, 32, 29, 34, 25, 30]
drops = [a - b for a, b in zip(normal, now)]
print("C/N0 drop per satellite (dB):", drops)
if min(drops) > 6:
    print("every satellite dropped by more than 6 dB at once: treat as interference, log time and place, rely on inertial or other sources")

all 8 satellites: test statistic 186.8 threshold 18.47 -> fault detected
  residuals (m): -4.7, -0.3, -4.3, +16.1, -7.6, -6.1, +4.7, +1.9   horizontal error 6.1 m, vertical -8.38 m
  without satellite 1 : statistic 169.6 fault remains errors H  5.07 V -14.63 m
  without satellite 2 : statistic 186.8 fault remains errors H  5.99 V  -8.31 m
  without satellite 3 : statistic 164.6 fault remains errors H  8.72 V  -1.25 m
  without satellite 4 : statistic   0.3 consistent    errors H  1.71 V   1.89 m
  without satellite 5 : statistic 130.5 fault remains errors H 12.87 V  -3.91 m
  without satellite 6 : statistic 159.9 fault remains errors H  7.13 V -14.65 m
  without satellite 7 : statistic 151.2 fault remains errors H 10.73 V -21.54 m
  without satellite 8 : statistic 184.1 fault remains errors H  7.16 V  -8.38 m
C/N0 drop per satellite (dB): [13, 13, 12, 13, 12, 13, 12, 13]
every satellite dropped by more than 6 dB at once: treat as interference, log time and place, rely on inertial or other sources

With all eight satellites the test statistic is 186.8, far above the threshold of 18.47 for four degrees of freedom and a false-alarm probability of 0.001, so a fault is detected; the faulty solution is 6.1 m off horizontally and 8.4 m vertically. Removing each satellite in turn, only the subset without satellite 4 passes the test, with a statistic of 0.3, and its errors return to the 2 m level expected from the noise. The fault is identified and excluded. In the second part every satellite's C/N0 has dropped by 12 to 13 dB at the same moment. A single obstruction affects only the satellites behind it; a simultaneous drop on all satellites, in all directions, is the signature of interference.

Interference and jamming

GNSS signals arrive at the antenna about 20 dB below the thermal noise, so it takes very little power to overwhelm them. Unintentional interference comes from harmonics of other transmitters, faulty amplifiers in television antennas, some lighting and electronic equipment, and occasionally from solar radio bursts, which raise the noise across the whole sunlit hemisphere for minutes. Intentional jamming is the deliberate transmission of noise or tones in the GNSS bands. Small jammers plugged into a vehicle's power socket, sold as privacy devices, can disrupt receivers for hundreds of meters to kilometers around a highway, as on the canal job. Military jamming in conflict zones has disrupted GNSS for civil aviation and shipping over wide areas in recent years.

In the United States, the Federal Communications Commission prohibits the marketing, sale and use of jamming equipment by the public, and it can impose substantial fines. Interference can be reported to the FCC and, for GPS, to the U.S. Coast Guard Navigation Center, which collects reports of GPS problems from civil users. Surveyors who experience interference should record the time, place, affected signals and receiver data with their report.

The effects of interference build up as its power rises: C/N0 falls on all satellites, carrier tracking becomes noisy and slips cycles, RTK fixes are lost, then carrier tracking fails while code tracking continues for a while, and finally the receiver loses all signals. Receivers monitor the automatic gain control of their front end, which reduces gain when broadband power rises, and C/N0 across satellites; together these are simple and effective detectors. Spectrum displays in some receivers show the shape and frequency of the interference. Mitigation measures include placing antennas to shield them from the horizon where interference sources such as roads lie, using receivers with notch and pulse-blanking filters, tracking several frequency bands so that narrowband interference in one leaves the others usable, using inertial and other sensors to bridge disruptions, and, for critical installations, controlled reception pattern antennas, arrays that steer nulls toward interference sources.

Spoofing

Spoofing is the transmission of counterfeit GNSS signals intended to make a receiver compute a false position or time. Because the open signals are fully documented and carry no authentication, a sufficiently capable transmitter can, in principle, imitate them. A simpler variant, meaconing, rebroadcasts real signals received elsewhere, with a delay. A successful spoof can be more dangerous than jamming, because the receiver continues to report a position and a good-looking accuracy, while the position or the time slowly diverges from the truth. Spoofing has been reported affecting ships and aircraft in several regions; for civil infrastructure, the most worrying targets are the timing receivers that synchronize telecommunications networks, power grids and financial systems, which often take their time from GNSS alone.

This lesson is concerned with recognizing and resisting spoofing, not with how it is done. The defenses rely on the fact that counterfeit signals are hard to make consistent with every independent check a receiver can apply. Defenses fall into four groups:

Galileo's OSNMA, operational since July 2025, lets receivers verify that the navigation data come from Galileo. Authentication of the data does not by itself prove that the ranging signal is genuine, since a meaconer can rebroadcast authentic data with a delay, but it raises the bar considerably and works together with consistency and timing checks. Navigation message authentication for other systems is being studied and developed, and future signals may add encrypted spreading codes for authorized users. For timing users, guidance from national agencies on resilient positioning, navigation and timing encourages holdover clocks, multiple independent time sources and monitoring rather than reliance on a single GNSS receiver.

Defensive practice for surveyors and engineers

Most survey work will never meet deliberate spoofing, but the same habits defend against interference, faults and blunders. Know what normal looks like at a site: record typical C/N0, satellite counts and fix times, so that an abnormal day stands out. Keep raw observation data rather than only positions, so that a suspicious result can be reprocessed and tested. Use multiple constellations and frequencies. Check every session against independent control and repeat critical observations at different times. In machine control and monitoring systems that run unattended, set alarms on C/N0 and AGC, on the number of tracked satellites and on jumps in position or receiver clock, and design the system to degrade safely, stopping a machine or flagging data rather than continuing on bad positions. For permanent monitoring stations and timing installations, place antennas with a clear view of the sky but shielded from roads, use interference-resistant antennas where justified, and keep a stable local clock to detect time jumps.

On the canal job, the base log showed that the October event lasted 21 minutes and coincided with a large drop in AGC. Ruth filed a report with the time and location and the receiver data, the crew re-observed the stakes set during that window, and the firm moved its base for highway-side work a few hundred meters back from the road, behind a berm. None of that required special equipment: only knowing the signatures, keeping the data and checking the work.

Course summary

This course followed the chain from satellites to coordinates. The constellations and their signals provide pseudoranges and carrier phases. Orbits and clocks place the satellites; least squares and DOP turn ranges into positions; error sources limit what one receiver can do alone. Differential methods remove common errors; carrier-phase ambiguity resolution unlocks millimeter precision in static, RTK and PPP positioning; networks and services connect every result to the national frame at a stated epoch; inertial integration fills the gaps; and integrity monitoring tells the user when not to trust the result. GEOM-310 and later courses build on these foundations for photogrammetry, lidar, hydrography and engineering surveys.