Maritime GNSS spoofing campaign attributed to the Russian Federation (2016-2018)
What happened
Between February 2016 and November 2018, C4ADS documented 9,883 suspected GNSS spoofing instances across 10 locations in the Russian Federation, Crimea and Syria, affecting the navigation systems of 1,311 civilian vessels. Counterfeit GNSS signals displaced receivers' reported positions, in some cases by tens of nautical miles onto land. The best-documented single episode is the Black Sea event of 22 June 2017, in which more than twenty vessels reported positions near Gelendzhik airport, roughly 25 nautical miles inland from their actual positions, with receivers showing abnormally high signal strength from every satellite at once. C4ADS attributes the activity to Russian state entities on the basis of correlation with head-of-state movements, traced basing locations and identified equipment, including at Khmeimim airbase in Syria. Bhatti and Humphreys independently demonstrated the mechanism under controlled conditions, taking hostile control of a 65-metre vessel in the Mediterranean via counterfeit civil GPS signals.
A campaign rather than a single incident: recorded as an incident because the incident loader has no campaign path, though the schema's campaigns table fits it better. Confidence is moderate on the record as a whole rather than on the underlying facts, which are well established: what is uncertain is whether SPARTA's PNT techniques, written with the spacecraft as the deceived party, should carry a campaign whose victims are shipborne receivers. See the scope discussion in the accompanying markdown; a hold is recommended pending that ruling.
Attack vector
Transmission of counterfeit GNSS signals from terrestrial and mobile transmitters, causing civilian marine receivers to compute attacker-chosen positions.
Operational impact
Navigation systems of 1,311 civilian vessels affected across 10 locations over roughly two and a half years. In the June 2017 Black Sea episode, over twenty vessels simultaneously reported positions approximately 25 nautical miles inland.
Affected segments
user, link
Disclosed
2019-03-26
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
C4ADS documents 9,883 suspected instances in which GNSS-like signals were transmitted so that civilian marine receivers produced attacker-chosen positions, affecting 1,311 vessels across 10 locations. Bhatti and Humphreys demonstrate the same mechanism under controlled conditions, taking hostile control of a 65-metre vessel via counterfeit civil GPS signals. The technique's transmitting clause is met exactly. Its stated victim is the spacecraft's own navigation solution, and here the victim is a shipborne receiver, which is why this is derived rather than direct and why the record carries a hold.
On C4ADS's analysis the purpose of the activity is to make the affected party act on a false picture, for VIP protection, strategic facility defence and airspace denial. Bhatti and Humphreys show the induced course deviation can be shaped to resemble the effect of ocean current, so that it does not present to the crew as an attack at all. IMP-0001's definition, falsification of information to induce a reaction prejudicial to the victim's interests, is met, but no source uses the term, so the edge is derived.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
GNSS spoofing necessarily shifts the receiver's time solution as well as its position, but no source used here documents a timing effect in this campaign. This is exactly the "could have happened" case the brief excludes.
C4ADS's dataset is spoofing. Jamming is mapped in the separate aviation record where sources document it.
C4ADS identifies transmit equipment at named locations, but RD-0001.01's subject is an RF ground stack for reaching a spacecraft: steerable mounts, band-appropriate apertures, TT&C modems. A GNSS-band spoofing transmitter is not that, and mapping it would stretch the technique to cover any transmitter.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: Named research organisation, methodology stated (AIS data plus an ISS-mounted scientific sensor), findings quantified and geolocated. Not peer-reviewed and not a government record, so not Tier 1.
- Hostile Control of Ships via False GPS Signals: Demonstration and DetectionPeer-reviewed papersupporting
Tier 1: Peer-reviewed paper in NAVIGATION, the journal of the Institute of Navigation, reporting a field experiment in which a vessel's GPS receiver was captured by counterfeit signals, and proposing a detection method.
Tier 3: Named maritime trade outlet, reporting the content of a government safety alert and of masters' reports to the US Coast Guard Navigation Center rather than conducting its own analysis.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.