PYA SUPPLEMENT – AUTUMN / WINTER 2013
transportation
to
finance
to
energy
distribution, have a built-in dependence on
you’ve got nothing to automatically calculate
ship’s rhumb line, in which case the ship’s
course over ground.
compass readings will initially deviate slightly
civil GPS whose extent we are only now
Despite the protestations of equipment
from the course but will eventually come to
coming to appreciate. But the very virtues that
on the bridge, experienced mariners know
rest at the proper rhumb line bearing. It’s true
make civil GPS technology so easy to co-opt
what to do in the event of a clearly-indicated
that the spoofer won’t be able to avoid
into any hardware or app, and have made
GPS outage. The first priority is collision
causing an inconsistency between the radar
them the basis for modern maritime
avoidance, for which, barring underwater
data and the ECDIS charts, but the Officer of
navigation, give rise to a dangerous weakness;
hazards and low-profile vessels, a visual
the Watch may not notice the discrepancy
civil GPS signals can be counterfeited or
lookout and radar targeting are usually
until it’s too late.
spoofed. Like Monopoly money, they have a
sufficient. For navigation, there are several
What would a spoofing attack look like
detailed structure but no deliberate protection
options. If one has the benefit of starting from
in practice? Suppose the spoofer’s goal is to
against counterfeiting.
a known location (e.g. if the last coordinates
run the target vessel aground on a shallow
Instinctively, one might dismiss GPS
produced by the GPS unit are correct), then
underwater hazard. After taking control of the
spoofing as just another common GPS
one can dead reckon from this starting point
ship’s GPS unit, the spoofer induces a false
anomaly like signal blockage or jamming. But
with a combination of water speed sensor and
trajectory that slowly deviates from the ship’s
it’s not, it’s different. To understand the
compass data. If no accurate starting point is
desired trajectory. As cross-track error
difference, it’s worthwhile stepping back and
available, or if dead reckoning has built up
accumulates, the ship’s autopilot or Officer of
considering how GPS is used in the modern
substantial uncertainty due to inaccurate sea
the Watch manoeuvres the ship back into
maritime world.
current set and drift estimates and slight
apparent alignment with the desired trajectory.
With your ship in clear and open seas,
compass errors, then a navigator must fall back
In reality however, the ship is now off course.
try this experiment to get a sense for your
on some absolute navigational reference. Near
After several such manoeuvres, the spoofer
ship’s dependency on GPS: Switch off all your
shore, it’s often possible to get an absolute fix
has forced the ship onto a parallel track
ship’s GPS units and note what happens. The
by taking bearing measurements off local
hundreds of metres from its intended one.
AIS unit will immediately sound an alarm,
landmarks. A bit further out, a standard ‘blind
Now as the ship moves into shallow waters,
complaining that it can’t broadcast the ship’s
navigation’ practice is to use depth sounder
the ECDIS display and the down-looking
GPS-derived position and velocity to nearby
readings to follow a depth contour line from a
depth sounder may indicate plenty of
vessels and to traffic planners onshore. The
chart of the approximate local area. If all else
clearance under the keel, when in truth a
insistent AIS alarm will soon be joined by one
fails, the seasoned mariner can always resort
dangerous shoal lies just underwater dead
from the ECDIS, which will point out that you
to sextant and chronometer for absolute, albeit
ahead. Maybe the Officer of the Watch will
can’t expect it to plot your ship’s co-ordinates
approximate, latitude and longitude.
notice the strange offset between the radar
and velocity against a background chart of the
One might think that a GPS spoofing
overlay and the underlying electronic charts.
local area, showing progress along the planned
attack presents no more danger to a marine
Maybe, thinking quickly, he will reason that
route, without data from the GPS unit. The
vessel than a GPS outage, but this is not
the radar data is more trustworthy than the
radar system will then join the strident chorus;
the case. The difference is that a subtly
ship’s GPS-derived position icon displayed on
how is it supposed to convert from relative to
executed spoofing attack can be almost
the ECDIS. And maybe he will have the
absolute target coordinates without GPS?
perfectly surreptitious; no alarms will sound,
presence of mind to deduce the ship’s true
That’s probably the extent of the alarms you’ll
no obviously bad data will be registered.
location from the radar data, recognize the
hear but in fact, other insidious errors are
To begin with, the spoofer will have no
looming danger and swing clear of the shoal
building up silently now that the GPS unit is
trouble covertly fooling the GPS unit; even
to avert disaster… or maybe not.
off. The gyrocompass’s internal steaming error
the latest commercial units are entirely
correction will be degraded without a latitude
incapable of detecting a spoofing attack like
Todd E. Humphreys
estimate, and any automatically applied
the one demonstrated on the White Rose;
Assistant Professor, Aerospace Engineering
magnetic variation values won’t have the
false and authentic signals are absolutely
The University of Texas at Austin
benefit of an approximate earth location.
indistinguishable to these devices. To avoid
210 E. 24th St. Stop C0600
Finally, the set and drift estimates of sea
detection from cross-checks against the
Austin,TX 78712-1221
currents in your area (the ones you’ll need for
onboard compasses, a spoofer can adopt a
Office:WRW 411C
dead reckoning now that you’ve got no GPS
strategy of gradually easing a ship, miles off
Phone: (512) 471-4489
data) will slowly become irrelevant because
course onto a track running parallel to the
www.radionavlab.ae.utexas.edu/
>||
PYA SUPPLEMENT / YACHTING MATTERS & THE YACHT OWNER ISSUE 25
127