28 SEP 23 PAGE 1 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

This information covers a developing event: further versions will likely follow. Check Dashboard / Daily
Brief for updates. Please report any additional information you have to [email protected]. Thank you!

TO: ALL OPSGROUP MEMBERS

ATTN: OPERATING FLIGHT CREW, FLIGHT OPS DEPARTMENTS, SAFETY DEPARTMENTS

Quick Summary - Version 2 update

• Enroute aircraft are being targeted with fake GPS signals, leading to complete navigation
failure. One aircraft almost entered Iranian airspace without clearance.
• We now have 20 separate reports. Types updated to include Embraer 190, 600, Legacy 650,
Boeing 737/747/777, G650, Challenger CL604, CL650, Falcon 8X and Global Express.
• Location: Primary concern area is Airway UM688. Majority focused in northern Iraq – Baghdad
FIR (ORBB), close to border with Iran.
• This is not GPS jamming – this is GPS spoofing, and of a type not seen before.
28 SEP 23 PAGE 2 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Key information for Flight Crew

We’re all used to seeing GPS jamming enroute, including the increase since around 2018, and experienced by
many aircraft in Turkey, the Eastern Mediterranean, the Middle East, Russia and Ukraine. GPS spoofing events,
where a fake GPS signal is transmitted, leading to a false aircraft position through the GPS input. Very few of us
have experienced this to date.

This month however, a new threat is emerging. A new variety of GPS spoofing is being reported by crews, where
the signal is sufficiently strong and of sufficient integrity to fool the aircraft systems. The result is that within
minutes, the IRS becomes unusable, and in many cases, all navigation capability on board is lost. In the
majority of reports we’ve received, Flight Crews have had to ask ATC for radar vectors. Given the types of airspace
that these events are occurring in, this presents significant risk. One crew reported almost entering Iranian
airspace without clearance.

Excerpt, full map follows in Maps section.

28 SEP 23 PAGE 3 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Situation
OPSGROUP has now received 20 separate reports (and counting) from flight crews that have experienced a false
GPS signal (GPS spoofing). The majority of these events have led to complete loss of navigational capability.
Aircraft have had to rely on radar vectors from ATC to navigate, until systems could be restored.

Common to the majority of events are the following:

• Fake GPS signal (spoofed) gives the FMS the indication it is 60nm off track
• IRS failure follows rapidly
• No reliable on board navigation – ATC vectors required

Aircraft types affected so far:

• Gulfstream G650
• Boeing 777, 747, 737
• Bombardier Global Express
• Bombardier Challenger 604, 650
• Embraer E190
• Embraer Praetor 600, Embraer Legacy 650
• Dassault Falcon 8X

Full crew reports are appended to this note.

28 SEP 23 PAGE 4 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Map

This map shows the first 10 reports received by OPSGROUP, all occurring in close proximity to the Iranian border.
Further reports are all in the same area.

A high-res version is available in your Dashboard at:

https://ops.group/dashboard/wp-content/uploads/2023/09/fake-gps-signal-map-1.jpg
28 SEP 23 PAGE 5 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Crew/Operator Reports

Aug 29, 2023 Gulfstream G650, vicinity of ORER (Erbil, Iraq). Crew lost navigational integrity over nearly entire
Iraqi airspace due to enroute high altitude GPS spoofing (Falsified position not jammed as usual). Aircraft then
entered full degrade. GPS was 60NM offset, the IRS were considered unreliable. To the crews observation there
were 3 or more aircraft affected. Situation was resolved by receiving radar vectors by ATC to fly along the airway.
UM688 RATVO to VAXEN, overhead ORBR and close to ORER at 15:50Z. GPS Signal that was emitted was very
strong and could be picked up by both hand held EFB moving maps. Due to the strength of the falsified GPS
signal, the GPS was considered valid by the aircraft system causing the large mismatch. Gulfstream G650 aircraft
with Honeywell avionics.

Sep 1, 2023. Boeing 737-800, southbound on UM688 (Northern Iraq). FL370, near VAXEN. The GPS spoofing
(75nm difference) seemed to confuse the FMC initially as DME updating wasn’t functioning (indicated by the white
font color on the FMC NAV STATUS page). After a period of time DME updating started again (indicated by the
green font color) and confirmed by the rapidly reducing ANP value. For us, there was no IRS failure or uncertainty.
By the time we’d recognized the issue and looked at the ‘UNABLE REQD NAV PERF - RNP’ QRH drill (which
doesn’t help as it doesn’t instruct to deselect GPS UPDATE) the DME updating had reestablished itself and ANP
had reduced to normal levels so vectoring wasn’t required. The main concern for us was our proximity to the
Iranian border at this point (10nm) when on the airway centerline, so any deviation could have serious
consequences.
28 SEP 23 PAGE 6 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Sep 9, 2023. Challenger 604, UM688 (Northern Iraq). Europe-Qatar. The dispatcher sent us through Turkey and
Iraq this time. A little more background, we were fighting IRS Drift all day so that didn’t help us either. To start we
had some minor jamming going around the corner from Bulgarian Airspace to Turkish. We’d keep one GPS on but
the other would stay off. We had both over central turkey but then nearing the corner again at Turkey/Iraq airspace
we lost both GPS sensors. So we carried on with available nav sensors. But then nearing north of Baghdad
something happened where we must have been spoofed. We lost anything related to Nav and the IRS’s suggested
we had drifted by 70-90 miles. We had a ground speed of zero and the aircraft calculated 250kts of wind. The
FMS’s reverted to DR (Dead Reckoning) and had no idea where they were. So we took vectors to get around the
corner at SISIN. We never got our GPS sensors back until we fired up the plane and went back to home base two
days later. So it was vectors all the way from Iraq to Doha for an ILS.

Sep 12, 2023 2030Z Falcon 8X, near Mosul (Iraq). As usual we lost GPS middle of Turkey on southbound. EPU
remains below 2NM. But around Mosul, GPS started to work again but with totally wrong position. Definitely
Spoofing. Error was around 80 NM EPU was rising quickly. We had to deselect manually GPS to regain normal
position. EPU went down again. No IRS issue reported. Falcon 8X with Easy IV.

Sep 15, 2023 Challenger 650 near ORBI (Baghdad, Iraq) targeted on airway UM688 from abeam SOBIL to SISIN,
for approx. 25 mins. The map shift was 60NM. Crew reverted to HDG mode and radar vectoring, followed by
green needles on the BSR VOR. Because the map shift happened very quickly the crew realised what was
happening and reverted to DR, green needles VOR flying, and asked an update from ATC.

Sep 15, 2023 Embraer Legacy 650, Airway UM688. We also had the same problem with GPS spoofing on the
15th of September on our way from XXX to Dubai. In Baghdad airspace we lost both GPS in the aircraft and on
both iPads. Even the IRS didn’t work anymore. So we had to request radar vectors. We were about 50-80NM off
the track. We nearly entered the Iran airspace with no clearance. We only realized it because the autopilot
started turning to the left and right, so it it was obvious that something was wrong. After couple of minutes we
got error messages on our FMS regarding GPS, etc. It was on the airway UM688 between the points RATVO,
SOBIL and VAXEN. FL370 and it lasted about 20-30 min. Everything came back online after SISIN and we could
resume own navigation as normal.
28 SEP 23 PAGE 7 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Sep 16, 2023 Global Express, vicinity of ORBI (Baghdad, Iraq). The usual loss of GPS followed by a 60nm
position offset. System went straight from GPS to FMS DR. The IRS/DME/VOR backups had completely lost
positions as well. We were 5nm above and behind a BA 787 who did not report any issue. Bombardier aircraft,
Rockwell Collins Vision avionics.

Sep 19-21, 2023 Embraer 190, northern Iran/Azerbaijan. Several incidences of real GPS spoofing, at the beginning
it was like GPS 1 GPS 2 message, usually it takes place in critical regions, so it is not a surprise for us. But at this
time two IRSs which are updated from GPS, lost position. FMS disagree messages appeared. 13 years on this
aircraft, tried everything that I know but nothing helped and only VOR/DME navigation was available. Equipped
with Honeywell FMS, aircraft have almost last Primus Epic load 27.4. FMS relies on SBAS augmentation to avoid
spoofing, but algorithms are wrong, that's why IRS mismatched by incorrect spoofing transmission. The main point
is to switch off GPS from FMS before or at the very beginning of spoofing. As soon as precious ( EPU) getting less -
switch off GPS receivers from navigation system. But! If you miss a moment, you will lose navigation capability!
28 SEP 23 PAGE 8 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Sep 19, 2023, Date TBC. Global Express, Northern Iraq. Enroute Europe-UAE. GNSS started to present issues on
entering Iraqi airspace near RATVO. We deselected both GPS inputs, they were both unreliable. As a result, we
were able to preserve IRS/DME/VOR position. iPad showed the aircraft position 100nm away from actual position.
It was actually showing a motionless position. Of course, the usual ADS-B loss in Turkey, and loss of Satcom – that
part was expected.

Sep 10-21, 2023 Boeing reports. Additional to the above direct reports are several reports noted by Boeing
operators, in the Kuwait and Baghdad FIR close to Iran airspace. One involves a European carrier on Sep 10, on
airway UM688, where the aircraft was heard asking for a time check and radar vectors from ATC. Other Boeing
types include B737 and B747 aircraft in the same area. After a short time of confusion, crew members took GPS off
IRS updating. In some events IRS was affected and radar vectors was the only method of navigation.

If you have similar reports to share, please send to [email protected]. All operator and crew
information is de-identified, these are shared only for the purposes of helping to understand the
issue.
28 SEP 23 PAGE 9 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Analysis

Over the weekend of September 23-24, OPSGROUP members were asked for assistance in analyzing these events.
A summary of what we discussed follows. Please Note! This is just a summary of various operator and crew
perspectives, and is shared for context only – no guidance is intended here.

This is new – and alarming …

Other than the 10 members reporting the spoofing events, almost none of us have experienced anything similar.
Routine jamming is common, where a GPS signal is lost for periods of time. This lost signal presents little issue as
the avionics suites are designed to handle it.

The spoofing reports are seen by all of us as alarming for two reasons: the sophistication of the methodology, and
the unexpected “infection” of the IRS.

The IRS is standalone – how can it be affected?

In the past, INS and IRS were fully self-contained systems. However, the technology in the flight deck is now far
more integrated. Many modern IRS systems use GPS to update the accuracy of the IRU as the flight progresses.

In general, the system is designed so that if there is a loss of signal or a suspected loss of integrity of the GPS
calculated position, then the IRS solution will be isolated and the plane will use the most recent DR solution
If however the system cannot tell it has a bad position solution due to sophisticated spoofing, if might well go
ahead and update the IRS with bad data. Ironically the ‘new and improved’ systems would be more vulnerable to
this type of malicious interference.

Another member (767 operator) spoke to an IRS expert for perspective – arguing that the IRS system is “stand
alone” and the only mixing between GPS and Inertial is inside the FMS and thus, the IRS couldn’t be
spoofed. He assured me it could. Not enough to lose the alignment platform, but enough to confuse the present
position and thus, none of the radio navaids are where they’re supposed to be.

Bleak picture – 777 asking ATC for the time and their position

In one incidence of the spoofing, we reviewed a 777 enroute in the Baghdad FIR (Sep 10) essentially asking ATC,
“What time is it, and where are we?”

This scenario seems unthinkable – but highlights the potential problem that these new GPS spoofing signals
present.
28 SEP 23 PAGE 10 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Avionics design around GPS issues

A repeated theme in the discussions was the perspective that FMS and IRS have only been designed to cope with
a loss of GPS signal, and not an intentional spoofed signal.

As such, the knock-on effect to the IRS from these spoofing events can be understood better. It seems that an
avionics logic upgrade to better deal with spoofed GPS signals would be helpful.

De-selecting GPS, isolating IRS

Very quickly it became clear that the apparent solution to this would be to de-select GPS inputs on entering known
spoofing areas (which are only beginning to be understood).

However, crews were concerned about what else might happen if you deselect GPS. Clear guidance from
OEM’s, Avionics, and operators are requested.

For example, de-select the GPS on the sensor page which will cause the NAV to degrade to DME/DME, VOR/DME
or IRS depending on the availability of nearby navaids. We are not talking about doing this for long periods of time. I
am imagining the spoofing area is somewhat localized so IRS drift rate should be pretty minimal.

Some FBW aircraft (like the Phenom) have so tightly integrated GPS into their design that the FAA issue warnings to
avoid areas where GPS spoofing or jamming may be active.

Why we are at risk as civil aircraft

Military grade GPS receivers are virtually impervious to this tactic (due to use of encrypted Y code) but civilian
avionics are very susceptible to spoofing and jamming since they use the unencrypted GPS signal and don't have
nulling antennas (which can selectively disregard a strong jamming signal).

Procedures

A handful of operators have already responded with initial procedures. We have combined these into a general
guide further in this note.

One summary from a technical expert provides a useful synopsis:

Most avionics suites are now engineered such that the IRS position is regularly GPS updated to ensure the highest
accuracy, if the GPS fails! Therefore If the GPS is jammed, then the IRS works from its last known position.
However if it receives a spoof position, the system still believes the GPS input received to be accurate as all
sources “say" the same thing, and this spoof position is then updated to the IRS(s) to match. However, most
avionics system know that a shift/gross-error has happened as ground based updates do not compute the correct
position, and will flag a navigation/map/position warning. However, all primary navigation systems end up being
28 SEP 23 PAGE 11 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

corrupted as a result. It has the potential to be very dangerous, and is part of the reason why pilots should back
up navigation still, with “green needles” / ground based aids wherever possible. Our dependance on GPS is not
always good!

I would recommend using conventional ground based navaids (DME/VOR/NDB) as far as practical, otherwise
request assistance from ATC. Some platforms may allow IRS systems to be disconnected from GPS auto-updating,
but most now do it in the background with no optional pilot interaction. Unless the IRS systems are completely
independent (the old fashioned ones that have to be initialised at startup location), GPS integration for frequent
position updates, is sadly the issue due to its vulnerability to spoofing. For those that can disable the updating, they
may wish to consider turning this function off, however it may impact on navigation capability, AFM requirements
and operational approvals.

I would recommend that pilots and operators reach out to their OEMs for their recommendations on dealing with
spoofing on their platform.
28 SEP 23 PAGE 12 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Guidance & Procedures

The following are only suggested guidance and procedures, to mitigate, and deal with, GPS spoofing events
leading to IRS failures. These are collated from OPSGROUP members and are not official – most operators have
no guidance on this yet. Talk to your OEM for aircraft specific guidance.

Awareness of risk locations

These GPS/IRS issues have been reported in the following FIR’s.

1. Baghdad FIR (ORBI) – in particular UM688 along the Iranian border, eastern and northern Iraq – close to
locations like Erbil,
2. Tehran FIR (OIIX) – northern Iran, Tabriz area
3. Baku FIR (UBBA)
4. Yerevan FIR (UDDD)
5. Ankara FIR (LTAA) – eastern part, near Iraq/Iran

Similar GPS spoofing issues are known to occur in the Tel Aviv FIR, especially on approach to Tel Aviv (LLBG) –
these have played out differently with no known IRS impact.

Recommended Procedure – entering risk area

1. Check enroute FIR NOTAMs for any GPS spoofing advice (in time this will likely be published)
2. Cockpit Preparation: Perform full IRS alignment if entering known area with GPS spoofing risk
3. Be aware of typical sensor hierarchy for FMS position: GPS, then IRS, DME/DME, VOR/DME, DR.
4. Consider de-selecting GPS sensor input if option available.
5. Review differences between GPS Jamming and GPS Spoofing.
6. Perform time check and set correct time on personal device or watch.
28 SEP 23 PAGE 13 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Recommended Procedure – active GPS spoofing

Talk to your OEM for aircraft specific guidance

Look for clues that the aircraft may be being targeted:

1. Large increase in EPU (eg. 1-2nm to 60nm)

2. Aircraft clock changes – incorrect UTC time
3. Incorrect FMS position
4. Large shift in GPS position displayed
5. Obvious ND/PFD warnings about position error
6. Other aircraft on ATC freq/121.5/air-to-air report clock issues, position errors, or request vectors.

If active spoofing confirmed:

1. Revert to heading mode
2. De-select GPS inputs as soon as possible (IRS infection is not immediate)
3. Confirm IRS integrity
4. Consider using OFP/CFP computed track between waypoints as guidance
5. Report to ATC so other aircraft are aware, and check position.
6. Remain IRS only until clear of risk area
28 SEP 23 PAGE 14 FAKE GPS ATTACKS (V2) OPSGROUP RISK WARNING

ISSUED BY OPSGROUP TEAM

RISK WARNING EMAIL [email protected]
WHATSAPP +1 747 200 1993
FAKE GPS SIGNAL ATTACKS
NAVIGATION FAILURES 28 SEP 2023 Version 2
.

Further updates

This information covers a developing event: further versions will likely follow. Check your
members Dashboard / Daily Brief for updates.

Much of the information is compiled from member feedback. If you have any expertise to share,
or information to add – please email [email protected], or send a WhatsApp message to +1 747
200 1993.

Thank you!

Contacts / Links

• Contact OPSGROUP Team: [email protected] | WhatsApp: +1 747 200 1993

• Member Dashboard: https://ops.group/dashboard
• Crewroom: https://ops.group/dashboard/about-crewroom/