Since fully opening to civilian use in 2000, the Global Positioning System (GPS) has woven itself pervasively into our lives. On land, water and in the air. Location, navigation, tracking, mapping, timing. In vehicles, phones, watches. Turn-by-turn navigation, transit bus times, mining, surveying...
GPS beams to Earth from 24 main satellites orbiting 20,000 km away, radio-frequency (RF) messages identifying the satellite and giving its position and the time.
A GPS receiver tunes to four satellites, computing the distance to each based on the time a message takes to arrive and the speed of light. Then the receiver computes its three-dimensional location in relation to the four satellites, and in relation to the earth.
The table below shows three low-power RF signals: cell phone, GPS and DSRC - a crucial Vehicle to Vehicle (V2V) wireless pr
otocol.
The weaker the RF signal, the more vulnerable that signal is to disruption by random noise injection attack (otherwise known as jamming). The table below starkly illustrates the extreme weakness of GPS signals.
The power of a GPS signal received at the Earth’s surface (1.78*10^-16 W) is weaker by more than five thousand billion times (5.62*10^+12) than the weakest DSRC RF signal power: (1.00*10^-03 W) used for V2V communications.
I believe it is important for transport authorities, engineering associations and ITS societies to confront the extreme vulnerability of GPS service to hostile parties using simple, inexpensive jamming attacks. Avoiding the issue will not help anyone.
Disruptive impact
The powerful asymmetry, between widespread disruptive impact, and modest resources for a wide-range GPS jamming effort, is highly appealing to a hostile party. Unlike hard terror attacks involving violence by explosives, guns and knives, wide-range GPS jamming - while unlawful - is non-violent but annoyingly obvious to a large number of people and organizations.
Short-range GPS jammers are commercially available. One typical model is a 0.960 Watt output power-jamming device for completely disabling GPS signals within 15m to as far away as 40m.
Vital question: what is the practical, long-distance range of a wide-area GPS jamming device that a hostile party with modest resources can realistically deploy in order to completely disable all GPS reception in a large contiguous geographic area?
The calculations are in the box (right) - but the key point is that a hostile party, using an inexpensive 3 kilowatt portable generator costing around $500, in a used fibreglass-bodied cube van costing around $10,000, is able to completely shut down GPS service over a circular area 1.5km in diameter.
Any competent electronics enthusiast, technician or engineer should be able to build the jamming electronics device from parts costing a few hundred dollars.
A hostile party operating a wide-range GPS jammer on a congested multi-lane expressway could enjoy an attractive disruption pay-off. Especially with a more sophisticated extra-far-reaching jammer set-up using a pair of parabolic-shaped antennas to focus all the jamming RF power in both forward and backward directions along the expressway’s axis of travel.
The simple power density formula used does not take into account radiation power losses due to humidity (water vapour) or rainfall in the air, but the argument for the asymmetrical appeal of a wide-range GPS jamming attack is nevertheless undeniable.
Instead of a fibreglass-bodied cube van, a smaller metal-bodied trades van could have its dual rear windows tinted, to disguise a pair of rearwards-facing parabolic antennas.
A smaller vehicle could carry a battery with storage capacity of 9kWh, giving three hours of jammer operation at 3kW power. The antennas could be disguised as roof racks, or hidden inside a plastic cargo or ski box mounted on roof racks.
Demonstrating vulnerability
The objective of repeated wide-area random-roaming GPS shutdowns is the so-called ’soft‘ terror of social demoralisation, not the hard terror of physical destruction.
The hostile party unleashing a series of newsworthy, widespread GPS jamming attacks on urbanites would vividly demonstrate the vulnerability of this technology.There is a great deal of anger on social media at the moment, and the ranks of the disaffected are growing. A small conspiracy of such people could easily develop GPS jammers and deploy them at randomly-selected times and locations, garnering a satisfying media frenzy.
Jamming defences
It is not easy to pinpoint the source of a GPS jamming attack. Defenders need sophisticated equipment for location by triangulation.
Mobility of jamming equipment complicates tracking, as does the brevity of a jamming session. A small team of roaming GPS jammers, rotating through a pseudo-random jamming schedule, will increase the interdiction challenge.
Authorities looking to arrest a jamming attacker could enlist citizen-volunteers with mobile phones having GPS receivers.
An app, on a large dispersed number of such devices, could report to a central computer, the exact time and location of onset and cessation of GPS signal loss due to a jamming attack. The central computer would compute a real-time map of jamming effect zones, which would assist location by triangulation.
Some high-end smartphones have inertial sensors (accelerometers and gyroscopes) used to track movement in the absence of GPS signals. However, inertial sensors have a drift effect that requires correction from a GPS signal every few minutes.
As visible light is immune to RF jamming, my own jam-proof ITS technology for traffic congestion mitigation - Expressway Traffic Optimization (ETO) - uses a combination of luminous signals to drivers’ eyes, and fibre-optic communications.
But however we approach this, we must acknowledge that there is a potential danger to GPS signals from jammers – and confront the problem unless we want ‘GPS is down‘ to become the new normal.
How to calculate a jammer’s effective range
The power density formula is the simplest formula used by electronics RF engineers to calculate the effective signal power of a radio transmitter.
The RF transmitter antenna is assumed to be at the centre of a sphere, with the receiver antenna at a given distance (radius) from the transmitter, on the surface of the sphere. The signal power radiated from the sphere centre, is assumed to be spread uniformly over the entire surface area of the sphere.
The formula for the surface area of a sphere of radius R is 4 * pi * R^2
The RF power density formula is:
Where:
P S = power density [Watts / m^2] at distance R,
S = --------------- P = RF signal power [Watts] at antenna,
4 * pi * R^2 pi = 3.14,
R = radius of sphere in meters [m].
We know that a short-range GPS jammer (#1) with a power output of:
P1 = 0.960 [W]
can jam GPS signals as far away from the jammer’s antenna as: R1 = 15 [m]
We assume that the wide-range jammer (#2) uses a portable electric generator with an output power of three kilowatts = 3000 [W], and that the jammer device is 90% efficient, so the radiated power at the jammer’s antenna is:
P2 = 0.9 * 3000 [W.] = 2700 [W]
The power density S2 [W / m^2] of the wide-range jammer, at its maximum
effective range R2 [m], must be equal to the power density S1 [W / m^2] of the short-range jammer at its 15 [m] range:
P1 P2
S1 = ----------------- = S2 = ---------------- [W / m^2]
4 * pi * R1^2 4 * pi * R2^2
Rearranging the equation to solve for R2 [m], the maximum effective range of the wide-range jammer:
4 * pi * R1^2 P2
R2^2 = ----------------- * ----------------- [m^2]
P1 4 * pi
R1^2 * P2
R2^2 = ----------------- [m^2]
P1
( R1^2 * P2 )
R2 = SQRT ( ------------------ ) [m]
( P1 )
( 15^2 * 2700 )
R2 = SQRT ( ------------------ ) [m]
( 0.960 )
R2 = SQRT ( 632,813 ) [m]
R2 = 795 [m]
The diameter D2 [m] of a circle, centred at the wide-range jammer’s antenna, within which circle all GPS signals are disrupted is:
D2 = 2 * R2 = 2 * 795 = 1590 [m]
ABOUT THE AUTHOR:
Steve Petrie, B.A.Sc., P.Eng. is a retired computer software professional engineer
