Society relies on GPS — and the technology is vulnerable

Time was when nobody knew, or even cared, exactly what time it was. The movement of the sun, phases of the moon and changing seasons were sufficient indicators. But since the Industrial Revolution, we've become increasingly dependent on knowing the time, and with increasing accuracy. Not only does the time tell us when to sleep, wake, eat, work and play; it tells automated systems when to execute financial transactions, bounce data between cellular towers and throttle power on the electrical grid.

Coordinated Universal Time, or UTC, the global reference for timekeeping, is beamed down to us from extremely precise atomic clocks aboard Global Positioning System (GPS) satellites. The time it takes for GPS signals to reach receivers is also used to calculate location for air, land and sea navigation.

Owned and operated by the U.S. government, GPS is likely the least-recognized, and underappreciated, part of our critical infrastructure. Indeed, most of our critical infrastructure would cease to function without it.

The problem is that GPS signals are incredibly weak because of the distance they have to travel from space, making them subject to interference and vulnerable to jamming and what is known as spoofing, in which another signal is passed off as the original. And the satellites themselves could easily be taken out by hurtling space junk or the sun coughing up a fireball. As intentional and unintentional GPS disruptions are on the rise, experts warn that our overreliance on the technology is courting disaster, but they are divided on what to do about it.

"If we don't get good backups online, then GPS is just a soft rib of ours, and we could be punched here very quickly," said Todd Humphreys, an associate professor of aerospace engineering at the University of Texas in Austin. If GPS was knocked out, he said, you'd notice. Think widespread power outages, financial markets seizing up and the transportation system grinding to a halt. Grocers would be unable to stock their shelves, and Amazon would go dark. Emergency responders wouldn't be able to find you, and forget about using your cellphone.

Humphreys got the attention of the U.S. Department of Defense and the Federal Aviation Administration about this issue back in 2008 when he published a paper showing he could spoof GPS signals. At the time, he said he thought the threat came mainly from hackers with something to prove: "I didn't even imagine that the level of interference that we've been seeing recently would be attributable to state actors."

More than 10,000 incidents of GPS interference have been linked to China and Russia in the past five years. Ship captains have reported GPS errors showing them about 30 miles inland when they were actually sailing off the coast of Russia in the Black Sea. Also well documented are ships suddenly disappearing from navigation screens while maneuvering in the Port of Shanghai. After GPS disruptions at Tel Aviv's Ben Gurion Airport in 2019, Israeli officials pointed to likely culprits in Syria, where Russia has been involved in the nation's long-running civil war. And last summer, the U.S. Space Command accused Russia of testing antisatellite weaponry.

These disruptions not only affect their targets; they can also affect anyone using GPS in the vicinity.

"You might not think you're a target, but you don't have to be," said Guy Buesnel, a position, navigation and timing specialist with the British cybersecurity firm Spirent. "We're seeing widespread collateral or incidental effects." In 2013 a New Jersey truck driver interfered with Newark Liberty International Airport's satellite-based tracking system when he plugged a GPS jamming device into his vehicle's cigarette lighter to hide his location from his employer.

The risk posed by our overdependency on GPS has been raised repeatedly at least since 2000, when its signals were fully opened to civilian use. Launched in 1978, GPS was initially reserved for military purposes, but after the signals became freely available, the commercial sector quickly realized their utility, leading to widespread adoption and innovation. Nowadays, most people carry a GPS receiver everywhere they go — embedded in a mobile phone, tablet, watch or fitness tracker.

An emergency backup for GPS was mandated by the 2018 National Timing and Resilience Security Act. The legislation said a reliable alternate system needed to be operational within two years, but that hasn't happened yet.

Part of the reason for the holdup, aside from a pandemic, is disagreement between government agencies and industry groups on what is the best technology to use, who should be responsible for it, which GPS capabilities must be backed up and with what degree of precision.

"We're becoming more nuanced in our approach," said James Platt, the chief of strategic defense initiatives for the Cybersecurity and Infrastructure Security Agency, a division of the Department of Homeland Security. "We recognize some things are going to need to be backed up, but we're also realizing that maybe some systems don't need GPS to operate" and are designed around GPS only because it's "easy and cheap."

The 2018 National Defense Authorization Act included funding for the Departments of Defense, Homeland Security and Transportation to jointly conduct demonstrations of various complements for and alternatives to GPS, which were concluded last March. Eleven potential systems were tested, including eLoran, a low-frequency, high power timing and navigation system transmitted from terrestrial towers at Coast Guard facilities throughout the United States.

"China, Russia, Iran, South Korea and Saudi Arabia all have eLoran systems because they don't want to be as vulnerable as we are to disruptions of signals from space," said Dana Goward, the president of the Resilient Navigation and Timing Foundation, a nonprofit that advocates for the implementation of an eLoran backup for GPS.

Also under consideration by federal authorities are timing systems delivered via fiber optic network and satellite systems in a lower orbit than GPS, and therefore have a stronger signal, making them harder to hack. A report on the technologies was submitted to Congress last week.

Prior to the report's submission, Karen Van Dyke, who oversees civilian use of GPS at the Department of Transportation, predicted that the recommendation would probably not be a one-size-fits-all approach but would embrace "multiple and diverse technologies" to spread out the risk. Indicators are that the government is likely to develop standards for GPS backup systems and require their use in critical sectors, but not feel obliged to wholly fund or build such a system for public use.

"They think the critical infrastructure folks should figure out commercial services to support themselves in terms of timing and navigation," said Goward. "I don't know what they think first responders, ordinary citizens and small businesses are supposed to do."

The fear is that debate and deliberation will continue, when time is running out.