GNSS Spoofing Forensics: Attribution and Technical Analysis

Global Navigation Satellite System (GNSS) spoofing has emerged as one of the most sophisticated threats to critical infrastructure, maritime navigation, aviation safety, and national security. Unlike jamming, which simply denies service, spoofing deceives receivers into calculating false positions, times, or velocities. This article examines the forensic methodologies required to investigate GNSS spoofing incidents, attribute attacks to their sources, and build legally admissible evidence.

1. Forensic Investigation Methodologies

GNSS spoofing forensics requires a systematic, multi-disciplinary approach that combines signal analysis, hardware examination, and digital evidence collection. The investigation framework consists of four phases:

1.1 Incident Detection and Initial Response

The first phase involves confirming that a spoofing incident occurred rather than natural signal degradation or equipment malfunction. Key indicators include:

Position anomalies: Sudden jumps in reported position inconsistent with platform dynamics
Time discrepancies: GNSS time diverging from authenticated time sources (NTP, atomic clocks)
Signal strength irregularities: Unusually high carrier-to-noise ratios (C/N₀) suggesting nearby transmission
Multi-constellation inconsistency: GPS, GLONASS, Galileo, and BeiDou reporting conflicting positions
Receiver alarms: Modern receivers with spoofing detection (RAIM, AAIM) triggering alerts

1.2 Evidence Preservation

Once spoofing is suspected, investigators must preserve volatile and non-volatile evidence:

RF recordings: Capture raw IQ samples from the affected frequency bands (L1: 1575.42 MHz, L2: 1227.60 MHz, L5: 1176.45 MHz)
Receiver logs: Extract NMEA sentences, binary logs, and internal diagnostic data
Network data: Preserve logs from augmentation systems (SBAS, GBAS) and timing servers
Environmental context: Document location, time, weather, and potential interference sources

1.3 Signal Reconstruction and Analysis

Recorded signals are processed using software-defined radio (SDR) tools to extract modulation parameters, code phases, and navigation messages. This enables comparison with authentic signal characteristics.

1.4 Attribution and Reporting

The final phase correlates technical findings with intelligence data, geographic analysis, and known threat actor profiles to attribute the attack.

2. Signal Analysis for Attribution

Signal analysis forms the technical core of GNSS spoofing forensics. Sophisticated analysis can distinguish between different spoofer types, estimate transmitter location, and identify unique hardware signatures.

2.1 Power Profile Analysis

Spoofed signals exhibit distinctive power characteristics:

Power ramping: Many spoofers gradually increase power to avoid detection, creating a characteristic ramp profile
Spatial power distribution: Signal strength decreases with distance from the spoofer, enabling triangulation
Polarization anomalies: Authentic GNSS signals are right-hand circularly polarized (RHCP); spoofers may exhibit different polarization

2.2 Code and Carrier Analysis

Detailed examination of spreading codes and carrier signals reveals spoofer characteristics:

Code phase coherence: Authentic signals from different satellites have independent code phases; spoofed signals may show artificial correlation
Doppler shift patterns: Real satellites exhibit predictable Doppler profiles based on orbital mechanics; spoofers may generate simplified or incorrect Doppler
Carrier phase continuity: High-quality spoofers maintain carrier phase continuity; low-quality units show phase jumps

2.3 Navigation Message Forensics

The navigation message contains critical forensic data:

Ephemeris analysis: Compare broadcast ephemeris with precise orbital data; spoofers may use outdated or simplified ephemerides
Time of week (TOW) consistency: Check for temporal inconsistencies across satellites
Health flags: Spoofers may incorrectly set satellite health indicators
Authentication signatures: Newer signals (OSNMA, Chimera) include cryptographic authentication that spoofers cannot replicate

2.4 Direction of Arrival (DoA) Estimation

Using antenna arrays, investigators can estimate the direction of spoofing signals:

Array processing: MUSIC, ESPRIT, and beamforming algorithms estimate signal arrival angles
Multi-site triangulation: Combining DoA estimates from multiple locations pinpoints spoofer position
Time difference of arrival (TDoA): Correlating signal arrival times across sensors provides additional location constraints

3. Hardware Fingerprinting Techniques

Just as firearms leave unique markings on bullets, GNSS spoofers exhibit hardware-specific signatures that enable device identification and tracking.

3.1 Radio Frequency Fingerprinting

Every RF transmitter has unique imperfections:

Carrier frequency offset: Crystal oscillator tolerances create device-specific frequency biases (typically ±1-10 ppm)
Phase noise profile: Oscillator quality determines phase noise characteristics, visible in signal spectra
Power amplifier nonlinearity: AM/AM and AM/PM distortion creates unique spectral regrowth patterns
Transient signatures: Turn-on/off transients contain device-specific information

3.2 Modulation Fingerprinting

Implementation details in the spoofer’s signal generation chain create identifiable patterns:

Pulse shaping: Filter characteristics (root-raised cosine roll-off, filter order) vary by implementation
DAC artifacts: Digital-to-analog converter quantization and sampling create spectral images
I/Q imbalance: Imperfect quadrature modulation produces image frequencies and constellation distortion

3.3 Protocol Implementation Fingerprinting

Software-defined spoofers exhibit protocol-level signatures:

Message timing: Navigation message update intervals may deviate from specification
Bit error patterns: Implementation bugs create consistent errors in generated messages
Feature support: Some spoofers omit optional message fields or use simplified data structures

3.4 Machine Learning Classification

Recent research applies ML techniques to hardware fingerprinting:

Deep learning: Convolutional neural networks classify transmitter identity from IQ samples with >95% accuracy
Feature extraction: Statistical features (spectral kurtosis, entropy, cyclostationarity) feed traditional classifiers
Transfer learning: Models trained on known devices can identify new instances of the same hardware

4. Legal Evidence Requirements

GNSS spoofing investigations often support criminal prosecution, regulatory enforcement, or international dispute resolution. Evidence must meet legal admissibility standards.

4.1 Chain of Custody

Documentation must establish unbroken custody of all evidence:

Evidence tags: Unique identifiers for each piece of evidence
Custody logs: Timestamped records of every transfer
Storage conditions: Documentation of environmental controls
Access records: Who accessed evidence and when

4.2 Technical Documentation

Expert testimony requires comprehensive technical documentation:

Methodology description: Detailed explanation of analysis techniques
Equipment calibration: Proof that measurement instruments were properly calibrated
Error analysis: Quantification of measurement uncertainties
Reproducibility: Demonstration that results can be independently verified

4.3 Expert Qualification

Courts must qualify experts before accepting testimony:

Education and training: Relevant degrees, certifications, and coursework
Experience: Years of practice, number of cases, publications
Professional recognition: Memberships, awards, peer review

4.4 International Legal Framework

GNSS spoofing may violate multiple legal regimes:

ITU Radio Regulations: Prohibit harmful interference to licensed services
National laws: Many countries criminalize GNSS interference (e.g., U.S. 47 U.S.C. § 333)
International aviation law: ICAO standards protect aviation navigation
Maritime law: SOLAS and IMO regulations govern maritime navigation safety

5. Case Study Analysis

5.1 Black Sea Spoofing Campaign (2017-2023)

Incident: Persistent GNSS spoofing affecting civilian aircraft and ships in the Black Sea region, particularly near Syria and Crimea.

Evidence Collected:

Aircraft ADS-B data showing position jumps of 20-50 km
Maritime AIS tracks revealing impossible vessel movements
Ground-based monitoring station recordings
Passenger reports of navigation system failures

Analysis Findings:

Spoofing signals exhibited power levels 30-40 dB above authentic signals
Direction of arrival pointed to military installations
Signal characteristics matched known Russian electronic warfare systems
Spoofing patterns correlated with military operations

Attribution: Multiple governments and researchers attributed attacks to Russian electronic warfare units protecting naval and air assets.

Legal Outcome: Diplomatic protests filed; no criminal prosecution due to sovereign immunity complications.

5.2 GPS Spoofing Attack on Iranian Drone (2011)

Incident: Iran claimed to capture a U.S. RQ-170 Sentinel drone by spoofing its GPS receiver.

Technical Analysis:

Reported technique: Gradual position offset to mislead autonomous landing system
Required sophisticated knowledge of UAV navigation algorithms
Demonstrated feasibility of targeted spoofing attacks

Forensic Lessons:

Highlighted vulnerability of autonomous systems to spoofing
Spurred development of anti-spoofing technologies (M-code, OSNMA)
Demonstrated need for multi-sensor navigation fusion

5.3 Commercial GPS Spoofing Device Seizure (2022)

Incident: Law enforcement seized commercial GPS spoofing devices marketed for “privacy protection.”

Evidence Analysis:

Hardware fingerprinting identified manufacturing source
Firmware analysis revealed capabilities and intended use
Purchase records traced distribution network

Legal Proceedings:

Prosecution under communications interference statutes
Expert testimony on spoofing capabilities and risks
Convictions resulted in fines and equipment forfeiture

Forensic Innovation: Case established precedent for hardware fingerprinting evidence admissibility.

6. Emerging Challenges and Future Directions

6.1 Advanced Spoofing Techniques

Emerging threats require evolved forensic capabilities:

Meaconing: Rebroadcasting authentic signals with delay creates difficult-to-detect spoofing
Partial spoofing: Targeting single constellations or frequencies while leaving others authentic
Collaborative spoofing: Multiple synchronized transmitters create spatially distributed false signals

6.2 Cryptographic Authentication

New signal authentication standards complicate both attacks and forensics:

Galileo OSNMA: Open Service Navigation Message Authentication provides cryptographic verification
GPS Chimera: Proposed civil signal authentication for L1C/L2C
Forensic implication: Authenticated signals provide definitive proof of spoofing when authentication fails

6.3 International Cooperation

GNSS spoofing is inherently transnational, requiring coordinated response:

Information sharing between national authorities
Standardized forensic methodologies
Joint investigation frameworks
Harmonized legal penalties

7. Conclusion

GNSS spoofing forensics represents a critical capability for protecting navigation infrastructure in an increasingly contested electromagnetic environment. Successful investigations require integration of signal analysis, hardware fingerprinting, legal expertise, and international cooperation. As spoofing technology advances, forensic methodologies must evolve in parallel. The development of authenticated signals, improved receiver resilience, and standardized investigation protocols will strengthen attribution capabilities and deter malicious actors.

The cases examined demonstrate that technical evidence, when properly collected and analyzed, can support attribution even in complex geopolitical contexts. However, legal and diplomatic challenges remain significant, particularly when state actors are involved. Continued investment in forensic research, international collaboration, and legal framework development is essential to address this growing threat.

About the Author

This article was prepared by security researchers specializing in GNSS vulnerability assessment and electronic warfare forensics. For technical inquiries or collaboration opportunities, contact the editorial team.

References

Bhatti, J., & Humphreys, T. E. (2017). Hostile Control of Ships via False GPS Signals. IEEE Transactions on Aerospace and Electronic Systems.
Graduate, A., et al. (2020). GNSS Spoofing Detection and Mitigation. Navigation Journal.
ITU-R. (2021). Handbook on Radio Frequency Spectrum Requirements for Civil Aviation.
U.S. Department of Transportation. (2022). GPS Spoofing and Jamming: Technical Analysis and Countermeasures.
European GNSS Agency. (2023). OSNMA Technical Reference Document.