SENTINEL PROJECT
REPORT ON GNSS VULNERABILITIES
SENTINEL Project – GNSS Vulnerabilities
The SENTINEL Project investigated a number of interconnected activities involving mission-critical or
safety-critical services which need to be able to “trust” GNSS signals at the point of use. The SENTINEL
Project was concerned with GNSS interference and jamming, and techniques for mitigating such jamming.
This Report also records some of the world-wide press and television coverage stimulated by presentations
of the results of SENTINEL at numerous conferences and symposia.
PROPRIETARY INFORMATION
THE INFORMATION CONTAINED IN THIS DOCUMENT IS THE PROPERTY OF CHRONOS TECHNOLOGY LIMITED. EXCEPT AS SPECIFICALLY AUTHORISED
IN WRITING BY CHRONOS TECHNOLOGY LIMITED, THE HOLDER OF THIS DOCUMENT SHALL KEEP ALL INFORMATION CONTAINED HEREIN
CONFIDENTIAL AND SHALL PROTECT SAME IN WHOLE OR IN PART FROM DISCLOSURE AND DISSEMINATION TO ALL THIRD PARTIES TO THE SAME
DEGREE IT PROTECTS ITS OWN CONFIDENTIAL INFORMATION.
© COPYRIGHT CHRONOS TECHNOLOGY LIMITED 2011.
Registered in England No. 2056049. Registered Office: Stowfield House, Upper Stowfield, Lydbrook, GL17 9PD.
VAT No: G.B. 791 3120 44
N.B. Only documents bearing the Document Status ‘APPROVED CHRONOS DOCUMENTATION’ in the panel below are
deemed official literature.
Originated by:
Document Status:
Prof. Charles Curry. BEng, CEng, FIET
RELEASED
Title: Managing Director,
Chronos Technology
SENTINEL Project – Report on GNSS
Vulnerabilities
Page 1 of 59
04 April 2014
RECORD OF ISSUE
Issue
Date
Author
Reason for Change
001
11/02/2014 CC
Final for Release
SENTINEL PROJECT – Project Report 001
04 April 2014
Page 2 of 59
1
2
2.1
2.2
3
4
4.1
4.2
4.3
4.4
4.4.1
4.4.2
4.5
4.6
4.6.1
4.7
4.8
4.8.1
4.8.2
4.8.3
4.9
4.9.1
4.9.1.1
4.9.1.2
4.9.2
4.9.3
4.9.3.1
4.9.3.2
4.10
4.11
5
5.1
5.2
5.3
5.4
5.5
5.6
5.7
5.8
5.9
5.10
6
6.1
TABLE OF CONTENTS
EXECUTIVE SUMMARY .................................................................................................................... 9
GENERAL ........................................................................................................................................... 9
SCOPE & APPLICABILITY ............................................................................................................ 9
ACRONYMS AND ABBREVIATIONS............................................................................................ 9
INTRODUCTION ............................................................................................................................... 10
BACKGROUND AND SCOPE OF THE RESEARCH ....................................................................... 10
THE SENTINEL PROJECT ......................................................................................................... 10
JAMMING EVENT DETECTION ALGORITHMS ......................................................................... 12
FLEXIBLE FIELD DEPLOYMENT ............................................................................................... 13
GPS (L1) JAMMING EVENTS AND SOME TEST RESULTS ..................................................... 14
TEST RESULTS – MOTORWAY NEAR AIRPORT RUNWAY ......................................... 14
TEST RESULTS – CITY OF LONDON ............................................................................. 17
WHO OR WHAT JAMS? .............................................................................................................. 19
NATION STATE & ENEMY JAMMING ........................................................................................ 19
NORTH KOREA JAMMING HITS SOUTH KOREA FLIGHTS .......................................... 19
TERRORIST JAMMING ............................................................................................................... 20
CRIMINAL JAMMING .................................................................................................................. 20
VEHICLE AND HIGH-VALUE ASSET THEFT .................................................................. 20
EVASION OF COVERT TRACKING ................................................................................. 21
DEFEATING GPS BASED ELECTRONIC TAGGING ...................................................... 21
CIVILIAN JAMMING .................................................................................................................... 21
AVOIDANCE OF FLEET TRACKING ................................................................................ 21
Detection of a specific jammer during SENTINEL........................................................ 21
The Newark Incident ..................................................................................................... 23
COMMERCIAL ADVANTAGE ........................................................................................... 24
ACCIDENTAL UNINTENDED CONSEQUENCE TO GNSS OF CELLULAR JAMMING . 25
“The Priest and the Jammer” ........................................................................................ 25
“The Quiet Carriage Traveller”...................................................................................... 25
SPOOFING .................................................................................................................................. 25
REBROADCASTING ANTENNA ................................................................................................. 26
APPLICATIONS VULNERABLE TO GPS JAMMING AND SPOOFING .......................................... 26
GBAS, SBAS, EGNOS & WAAS AIRCRAFT LANDING SYSTEMS ........................................... 27
WIRELINE TELECOMMUNICATIONS NETWORKS .................................................................. 27
WIRELESS TELECOM NETWORKS .......................................................................................... 27
ELECTRICITY GENERATION AND SUPPLY ............................................................................. 27
FINANCIAL TRADING ................................................................................................................. 28
TELEMATICS INSURANCE ........................................................................................................ 28
TRACKING OF ASSETS, FLEET VEHICLES & PEOPLE .......................................................... 28
ROAD USER CHARGING ........................................................................................................... 28
UNMANNED ROAD VEHICLES .................................................................................................. 28
GEOFENCED APPLICATIONS ................................................................................................... 28
JAMMERS, JAMMER TYPES & WHERE THEY COME FROM ...................................................... 29
TYPES OF JAMMERS ................................................................................................................. 29
SENTINEL PROJECT – Project Report 001
Page 3 of 59
04 April 2014
GPS-ONLY JAMMERS ......................................................................................................29
6.1.1
J220-C ..........................................................................................................................29
6.1.1.1
GP5000 .........................................................................................................................30
6.1.1.2
J242-G ..........................................................................................................................30
6.1.1.3
JAMMERS FOR GPS PLUS MOBILE PHONES ...............................................................31
6.1.2
J220-B ...........................................................................................................................31
6.1.2.1
JAMMER WEBSITES...................................................................................................................31
6.2
MITIGATION......................................................................................................................................31
7
MITIGATION TECHNIQUES ........................................................................................................31
7.1
RESILIENT TIMING ...........................................................................................................31
7.1.1
GPS ANTENNA TECHNOLOGIES ...................................................................................32
7.1.2
USE OF MULTIPLE FREQUENCIES ................................................................................32
7.1.3
USE OF MULTIPLE GNSS ................................................................................................32
7.1.4
ENHANCED LORAN (ELORAN) .......................................................................................32
7.1.5
LEGISLATION AND PROSECUTION ..........................................................................................34
7.2
EXPLOITATION ACTIVITY - JAMMING DETECTION SOLUTIONS ...............................................34
8
HAND-HELD JAMMING DETECTORS .......................................................................................34
8.1
CTL3510 GPS JAMMER DETECTOR ..............................................................................35
8.1.1
CTL3520 GPS JAMMER DETECTOR AND LOCATOR ...................................................35
8.1.2
24X7 REMOTE-NETWORKED JAMMING DETECTION ............................................................36
8.2
THE SENTINEL SENSORS ...............................................................................................36
8.2.1
SENTINEL SERVER OPTIONS ........................................................................................37
8.2.2
SENTINEL RESEARCH AND DEMONSTRATION SERVER GUI FEATURES ...............37
8.2.3
EXELIS SIGNAL SENTRY™ 1000 SYSTEM ....................................................................37
8.2.4
SENTINEL AS A 24X7 PNT RESEARCH PLATFORM ...............................................................38
8.3
ELORAN: CTL8200 - THE ELORAN PROOF-OF-CONCEPT UNIT................................39
8.3.1
VULNERABILITY MITIGATION TECHNIQUES – CRPA TECHNOLOGY ........................39
8.3.2
GPS APPLICATIONS – ANALYSIS OF VULNERABILITY ...............................................39
8.3.3
DISSEMINATION OF INFORMATION ..............................................................................................40
9
PRESS ACTIVITY ........................................................................................................................40
9.1
SYMPOSIA & CONFERENCE PRESENTATIONS .....................................................................40
9.2
FEATURE ARTICLES ..................................................................................................................40
9.3
GPS JAMMING TRIALS ....................................................................................................................41
10
UK TRIALS – SENNYBRIDGE ....................................................................................................41
10.1
UK TRIALS – MIRA ......................................................................................................................42
10.2
SWEDISH TRIALS – SWEDISH MINISTRY OF DEFENCE - FOI ..............................................42
10.3
CONCLUSIONS ................................................................................................................................42
11
AKNOWLEDGEMENTS ....................................................................................................................43
12
13
REFERENCES ..................................................................................................................................44
APPENDIX A EXAMPLES OF PRESS COVERAGE .......................................................................................45
A.1
ZD NET ........................................................................................................................................45
BRITISH APCO JOURNAL ..........................................................................................................45
A.2
THE NATIONAL ACHIVES ..........................................................................................................45
A.3
A.4
CAMBRIDGE WIRELESS ............................................................................................................45
GPS WORLD ...............................................................................................................................45
A.5
BBC NEWS TECHNOLOGY ........................................................................................................45
A.6
A.7
SCIENCE CITY OF BRISTOL ......................................................................................................45
SENTINEL PROJECT – Project Report 001
04 April 2014
Page 4 of 59
COUNTER TERROR EXPO ........................................................................................................ 45
A.8
WSTS ........................................................................................................................................... 46
A.9
INSIDE GNSS .............................................................................................................................. 46
A.10
DSEI ............................................................................................................................................. 46
A.11
COORDINATES ........................................................................................................................... 46
A.12
THE ENGINEER .......................................................................................................................... 46
A.13
GPS DAILY .................................................................................................................................. 46
A.14
ITPROPORTAL ............................................................................................................................ 46
A.15
TECHWEEK EUROPE ................................................................................................................ 46
A.16
BUSINESS WIRE......................................................................................................................... 47
A.17
FABIO GHIONI............................................................................................................................. 47
A.18
TECH WORLD ............................................................................................................................. 47
A.19
E&T .............................................................................................................................................. 47
A.20
NEW SCIENTIST ......................................................................................................................... 47
A.21
GIS CAFE .................................................................................................................................... 47
A.22
THE ECONOMIST ....................................................................................................................... 47
A.23
THE INQUIRER ........................................................................................................................... 47
A.24
REUTERS .................................................................................................................................... 47
A.25
TELEMATICS WIRE .................................................................................................................... 47
A.26
UNIVERSITY OF BATH ............................................................................................................... 48
A.27
GEO CONNEXION ...................................................................................................................... 48
A.28
FLEET DIRECTORY .................................................................................................................... 48
A.29
THE INDEPENDENT ................................................................................................................... 48
A.30
ROAD.CC ..................................................................................................................................... 48
A.31
THE GUARDIAN .......................................................................................................................... 48
A.32
THE GUARDIAN .......................................................................................................................... 48
A.33
THE TELEGRAPH ....................................................................................................................... 48
A.34
THE ECONOMIST ....................................................................................................................... 48
A.35
SECURITY BLOG ........................................................................................................................ 48
A.36
FLEET NEWS .............................................................................................................................. 48
A.37
GIS TIDINGS ............................................................................................................................... 49
A.38
AUSTRALIAN GOVERNMENT ACMA ........................................................................................ 49
A.39
IT NEWS FOR AUSTRALIA ........................................................................................................ 49
A.40
ROYAL INSTITUTE OF NAVIGATION ........................................................................................ 49
A.41
APPENDIX B ON-LINE AVAILABILITY OF GPS JAMMING DEVICES .......................................................... 50
JAMMER SITE BLOGS ............................................................................................................... 50
B.1
JAMMER4UK.COM ..................................................................................................................... 50
B.2
B.3
WWW.JAMMERFROMCHINA.COM ........................................................................................... 51
WWW.DHGATE.COM ................................................................................................................. 51
B.4
WWW.GLUSHILKA.COM ............................................................................................................ 51
B.5
B.6
WWW.ALIEXPRESS.COM .......................................................................................................... 51
WWW.CHINAECARTS.COM ....................................................................................................... 51
B.7
WWW.ALLJAMMER.COM ........................................................................................................... 52
B.8
B.9
WWW.CHINAJAMMER.COM ...................................................................................................... 52
WWW.ALIBABA.COM ................................................................................................................. 52
B.10
WWW.CHINAVASION.COM ........................................................................................................ 52
B.11
B.12
WWW.JAMMER-STORE.COM .................................................................................................... 52
SENTINEL PROJECT – Project Report 001
Page 5 of 59
04 April 2014
WWW.JAMMERALL.COM ...........................................................................................................52
B.13
WWW.MADE-IN-CHINA.COM .....................................................................................................53
B.14
WWW.ESIONWILL.COM .............................................................................................................53
B.15
WWW.SECURITYGADGET.ORG ...............................................................................................53
B.16
WWW.THEFIND.COM .................................................................................................................53
B.17
WWW.CHINAJIAHO.COM ...........................................................................................................53
B.18
WWW.JAMMERFUN.COM ..........................................................................................................53
B.19
WWW.PAKBIZ.COM ....................................................................................................................53
B.20
B.21
WWW.CELL-JAMMERS.COM .....................................................................................................54
APPENDIX C NEWS STORIES AND VIDEO PRESENTATIONS REGARDING GPS JAMMING..................55
C.1
BBC RADIO 4 – QUENTIN COOPER: FINDING A WAY: THE FUTURE OF NAVIGATION -
55
2013
FOX NEWS REPORT - 2012 .......................................................................................................55
C.2
BLOOMBERG - GPS JAMMERS THREATEN AIR TRAFFIC NAVIGATION – 2012 .................55
C.3
TED TALK: TODD HUMPHREYS: HOW TO FOOL A GPS - 2012 .............................................55
C.4
FOX NEWS REPORT ON SPOOFING -2013 .............................................................................55
C.5
GPS FOR HUMANITY -- THE STEALTH UTILITY - 2013 ...........................................................55
C.6
C.7
DUBAI AIRSHOW 2011 – MAXIM ANTONOV OF AVIOCONVERSIYA EXPLAINS JAMMERS55
APPENDIX D SYMPOSIA AND CONFERENCES FEATURING SENTINEL PRESENTATIONS...................56
COUNTER TERROR EXPO, LONDON .......................................................................................56
D.1
D.2
DSEI 2011, LONDON (INTERNATIONAL EVNT) .......................................................................56
NAVWAR MOU MEETING, UK (INTERNATIONAL AUDIENCE) ...............................................56
D.3
UK SPACE AGENCY SECURITY AND RESILIENCY UNIT .......................................................56
D.4
D.5
JOINT NAVIGATION CONFERENCE 2011, USA (CLASSIFIED) ..............................................56
D.6
ASSOCIATION OF CHIEF POLICE OFFICERS: INTERNATIONAL CONFERENCE OF
FORENSIC INVESTIGATORS .........................................................................................................................56
INSTITUTE OF NAVIGATION (ION) CONFERENCE 2011, USA (INTERNATIONAL EVENT) .56
D.7
D.8
EUROPEAN NAVIGATION CONFERENCE (INTERNATIONAL EVENT) ..................................56
SPACE WEATHER CONFERENCE, FRANCE ...........................................................................56
D.9
OTHER .........................................................................................................................................56
D.10
D.11
INTERNATIONAL CONFERENCE OF FORENSIC INVESTIGATORS (ICCDF), LONDON ......57
KTN GPS JAMMING CONFERENCE, NPL, TEDDINGTON, LONDON .....................................57
D.12
OFCOM ADCO R&TTE MEETING ..............................................................................................57
D.13
GNSS VULNERABILITIES CONFERENCE ................................................................................57
D.14
D.15
INTERNATIONAL COMMITTEE ON GNSS WORKSHOP, VIENNA ..........................................57
EUROPEAN GNSS AUTHORITY PRS WORKSHOP .................................................................57
D.16
CABINET OFFICE BRIEFING ON GNSS VULNERABILITY.......................................................57
D.17
D.18
JOINT PRESENTATION BY NATS AND CAA ON GNSS RESILIENCE, LONDON ..................57
NATS: ICAO NAVIGATION SYSTEM PANEL (SPECTRUM SUB GROUP), MONTREAL ........57
D.19
NATS: EUROCONTROL RNAV APPROACH IMPLEMENTATION SUPPORT GROUP (RAISG)57
D.20
D.21
GSA PRS MEETINGS, BRUSSELS ............................................................................................57
CGSIC INTERNATIONAL MEETING, NASHVILLE, TENNESSEE, USA ...................................57
D.22
KTN: RESILIENT PNT, NPL TEDDINGTON, LONDON ..............................................................57
D.23
ITSF 2012, NICE, FRANCE .........................................................................................................57
D.24
D.25
TRANSPORT RESEARCH LABORATORY ................................................................................58
CHATHAM HOUSE - CYBER & SPACE SECURITY WORKSHOPS - JAN & MAY ...................58
D.26
KTN LOCATION & TIMING EVENT: GPS JAMMING & MITIGATION, UK .................................58
D.27
D.28
SECURITY & POLICING, UK ......................................................................................................58
SENTINEL PROJECT – Project Report 001
04 April 2014
Page 6 of 59
WSTS, SAN JOSE, CALIFORNIA, USA ...................................................................................... 58
D.29
ICG WORKSHOP, HONOLULU .................................................................................................. 58
D.30
EUROCONTROL, BRUSSELS, BELGIUM ................................................................................. 58
D.31
DISRUPTIVE TECHNOLOGIES, UK ........................................................................................... 58
D.32
USNO, NAVIGATION & TIMING SYMPOSIUM, WASHINGTON DC, USA ................................ 58
D.33
ROYAL AERONAUTICAL SOCIETY – FUTURE WEAPONS, FARNHAM, UK .......................... 58
D.34
SECURITY EVENT, NETHERLANDS ......................................................................................... 58
D.35
CGSIC, NASHVILLE, TENNESSEE, USA .................................................................................. 58
D.36
D.37
SPRINT WORKSHOP ON SYNC & TIMING, KANSAS, USA ..................................................... 58
APPENDIX E ACRONYMS AND ABBREVIATIONS ....................................................................................... 59
LIST OF FIGURES
Figure 1: Architecture of the SENTINEL System ............................................................................................. 11
Figure 2: SENTINEL Map GUI ......................................................................................................................... 11
Figure 3: Jamming event caught by the UoB QuickThresh Algorithm ............................................................. 12
Figure 4: Same jamming event as Figure 3 caught by the FFT Algorithm ....................................................... 13
Figure 5: QuickThresh Mask ............................................................................................................................ 13
Figure 6: Multipath by Azimuth ......................................................................................................................... 13
Figure 7: SENTINEL Sensor beside ILS cabin................................................................................................. 15
Figure 8: Totals of GPS jamming events detected in each month from October 2012 to December 2013. .... 15
Figure 9: Totals of GPS jamming events detected in each hour of a day from October 2012 to December
2013 .................................................................................................................................................. 15
Figure 10: Totals of GPS jamming events on each day of the week from October 2012 to December 2013 . 16
Figure 11: Time signature of a typical GPS jamming event at this site. ........................................................... 16
Figure 12: Totals of GPS jamming events in each month from February 2013 to December 2013 ................ 17
Figure 13: Total number of GPS jamming events each day during the Christmas 2013 period ...................... 17
Figure 14: Totals of GPS jamming events in each hour of the day from February 2013 to December 2013 .. 18
Figure 15: Totals of GPS jamming events on each day of the week from February 2013 to December 2013 18
Figure 16: Time signature of a typical GPS jamming event at this site. ........................................................... 19
Figure 17: Total number of GPS jamming events detected in April 2011 and May 2011. ............................... 22
Figure 18: Totals of GPS jamming events detected in each hour of the day in April 2011 and May 2011. ..... 22
Figure 19: Totals of GPS jamming events detected on each day of the week in April 2011 and May 2011 ... 23
Figure 20: Timing Receiver under spoofing attack ........................................................................................... 26
Figure 21: Rooftop location of reradiating (red) and victim (blue) antenna. ..................................................... 26
Figure 22: J220-C GPS Only Jammer .............................................................................................................. 29
Figure 23: J242-G Jammer............................................................................................................................... 30
Figure 24: J220-B GPS & GSM Jammer .......................................................................................................... 31
Figure 25: GPS Antenna "Squatters" ............................................................................................................... 32
Figure 26: Anthorn eLoran Transmitter ............................................................................................................ 32
Figure 27: eLoran Stations ............................................................................................................................... 33
Figure 28: ECD, SNR and TOA Data from the Anthorn station plotted over 48 hours .................................... 33
Figure 29: Relative MTIE between GPS and eLoran ....................................................................................... 33
Figure 30: GLA QoS Display ............................................................................................................................ 34
Figure 31: eLoran (Blue) and GPS (Magenta) TIE Graphs. ............................................................................. 34
Figure 32 : eLoran (Blue) and GPS (Magenta) MTIE Graphs .......................................................................... 34
Figure 33: CTL3510 Jamming Detector ........................................................................................................... 35
SENTINEL PROJECT – Project Report 001
Page 7 of 59
04 April 2014
Figure 34: CTL3520 Jamming Detector and Locator .......................................................................................35
Figure 35: CTL3520 in use ...............................................................................................................................36
Figure 36: GAARDIAN/SENTINEL Sensor .......................................................................................................36
Figure 37: CTL8200 eLoran Timing Receiver ..................................................................................................39
Figure 38: CRPA Antenna ................................................................................................................................39
Figure 39: Vehicles in MIRA Test Facility .........................................................................................................42
Figure 40: Field Deployed Sensor in Weatherproof enclosure .........................................................................42
Figure 41: CTL3520 in use ...............................................................................................................................42
LIST OF TABLES
Table 1: Sensor types .......................................................................................................................................36
Table 2: Server Types ......................................................................................................................................37
Table 3: Server Features ..................................................................................................................................37
SENTINEL PROJECT – Project Report 001
04 April 2014
Page 8 of 59