GPS 'Spoofing' Could Threaten National Security

The good news is that, for now, it is still pretty hard to create a spoofer. Some of the study authors have been working on GPS technology for more than 15 years now. Kintner estimates it cost them over $1 million to build their spoofer (including manufacturing costs). Ledvina says the hardware alone was about $1,000.

The spoofer itself was the size of a briefcase and was plugged into the wall. The scientists also connected the spoofer to a GPS receiver with a cable instead of broadcasting the signal, which would have violated FCC regulations.

If they had broadcast the signal it would only go a few meters, which means the spoofer and the intended receiver would have to be physically close. Eventually the size of a spoofer could decrease to about the size of a pack of cigarettes.

That said, it only took two part-time students about a week of work each to build the spoofer. The cost of hardware and the expertise necessary to build the next spoofer will drop quickly as well, as Ledvina illustrates.

"Ten years ago it would have taken a grad student a few weeks to jam a GPS receiver," said Ledvina. "Now Virginia Tech probably has 100 students who, with the right equipment, could build a jammer in about ten minutes." Ledvina expects a similar trend to follow spoofing.

Spoofing is not a new concern.

In 2001, the U.S. Department of Transportation released a report on GPS that laid out six countermeasures to deter spoofing, such as adding additional, non-GPS instrumentation, or keeping humans in charge of decision instead of leaving them up to computers. But such measures can be expensive, and they don't necessarily solve the problem.

The Cornell and VT team has successfully found a way around five of the six countermeasures, and are currently working to crack the last one.

The only GPS systems that can't be spoofed are military systems used by some soldiers and GPS guided "smart-bombs," says Richard Langley, a GPS researcher at the University of New Brunswick who reviewed the Cornell and Virginia Tech research.

"The military GPS signals are protected against spoofing by using a secret encryption, so that only receivers with that encryption technology can access the signal," said Langley. "There is no such protection for civilian GPS use."

The large number of civilian GPS devices makes civilian encryption impractical, but it also goes against the creator's original purpose in developing GPS, which was to provide free access to anyone anywhere, said Langley.

Kitner and Ledvina are clearly concerned about the effect that releasing this information to the general public would have. They are, after all, exposing major flaws in vital systems. But ultimately, they released the information in the hope that it would inspire GPS manufacturers and others to put safety measures in place.

"We have a technology-dependent society, and that makes us more vulnerable," said Kintner.

Related Links:

How Stuff Works: GPS