How Military GPS Denial and Spoofing Work: From Jamming Physics to Navigation Warfare

The GPS signal that arrives at your receiver has travelled 20,200 kilometres from a satellite transmitting at roughly 20 watts. By the time it reaches the Earth's surface, the power density is approximately -130 dBm, which is about 20 dB below the thermal noise floor of a typical receiver front end. The signal is, in a very literal sense, invisible without spread spectrum processing gain. A handheld transmitter putting out one watt of in-band power at a range of ten kilometres will produce a signal at the receiver that is tens of decibels stronger than the satellite. This asymmetry is the central vulnerability of satellite navigation, and it is the reason that GPS denial and spoofing have become defining features of modern electronic warfare.

GPS was designed in the 1970s for an era when the primary threat was the Soviet Union tracking carrier frequencies to target missile submarines. The system's architects gave military users an encrypted P(Y) code to prevent adversaries from generating fake signals, but they published the civilian C/A code openly so that anyone could build a receiver. That openness transformed global commerce, aviation, agriculture, and daily life. It also guaranteed that anyone with a basic understanding of RF engineering and a few hundred euros worth of components could attack the civilian signal. The military signal is harder to defeat, but not immune.

This article covers the physics of GPS jamming, the techniques behind GPS spoofing, the military countermeasures designed to maintain navigation in denied environments, and the fallback technologies that operate when satellites are unavailable entirely.

GPS Signal Fundamentals: Why the System Is Vulnerable

Understanding GPS vulnerability requires understanding the signal budget. A GPS satellite in the current Block III generation transmits navigation signals on three carrier frequencies, all derived from the onboard atomic clock's fundamental 10.23 MHz reference:

• L1 at 1575.42 MHz (154 x 10.23 MHz): carries the civilian C/A code and the new L1C signal, plus the military P(Y) code and M-code.
• L2 at 1227.60 MHz (120 x 10.23 MHz): carries the military P(Y) code, M-code, and the civilian L2C signal on newer satellites.
• L5 at 1176.45 MHz (115 x 10.23 MHz): a newer civilian signal designed for safety-of-life applications, available on Block IIF and later.

The C/A code is a Gold code with a chipping rate of 1.023 Mchips/s and a code length of 1,023 chips, repeating every millisecond. The P(Y) code runs at 10.23 Mchips/s, ten times faster, with a code period of one week. The new M-code uses a Binary Offset Carrier (BOC) modulation that splits its energy away from the existing signals, occupying spectral sidebands centred on L1 and L2.

The critical number is the received power. A GPS satellite transmits L1 C/A at roughly 25 watts EIRP toward the Earth. After propagating through 20,200 km of free space, the signal arrives at the surface with a power flux density that yields approximately -128.5 dBm for a 0 dBi receive antenna, commonly quoted as -130 dBm for a typical patch antenna with slight losses. The thermal noise floor for a receiver with a 2 MHz bandwidth at room temperature (290 K) is:

N = kTB = (1.38 × 10⁻²³ J/K)(290 K)(2 × 10⁶ Hz) = 8.0 × 10⁻¹⁵ W ≈ -111 dBm

The raw signal-to-noise ratio is therefore about -130 - (-111) = -19 dB. The signal is 19 dB below the noise floor. It is not detectable by conventional means.

GPS receivers extract this signal using spread spectrum processing gain. The C/A code's 1,023-chip sequence, when correlated over one code period (1 ms), provides approximately 30 dB of processing gain. This effectively raises the signal 30 dB above where it would be without the code correlation, yielding a post-correlation SNR of roughly +11 dB, which is sufficient for reliable acquisition and tracking. The P(Y) code, with its ten times higher chipping rate, provides about 10 dB more processing gain than C/A.

The problem is that a jammer does not need to overcome the processing gain permanently. It needs to raise the noise floor at the receiver's RF front end to the point where the analogue-to-digital converter saturates or the correlation process fails. A sufficiently powerful in-band signal, whether noise or a continuous wave tone, can overwhelm the receiver's automatic gain control (AGC), compress the dynamic range, and prevent the spread spectrum correlator from functioning.

GPS Jamming: The Physics of Overpowering a Satellite

Consider a concrete scenario. A GPS satellite 20,200 km away delivers -130 dBm at the receiver. A ground-based jammer transmitting 1 watt (30 dBm) of in-band power is located 10 kilometres from the target receiver. The free-space path loss at L1 (1575.42 MHz) over 10 km is:

FSPL = 20 log₁₀(4πd/λ) = 20 log₁₀(4π × 10,000 / 0.1905) = 20 log₁₀(6.6 × 10⁸) ≈ 116.4 dB

The jammer power at the receiver is therefore 30 - 116.4 = -86.4 dBm. The jammer-to-signal ratio (J/S) is:

J/S = -86.4 - (-130) = 43.6 dB

A one-watt jammer at 10 km produces a signal 43.6 dB stronger than the GPS satellite. Even after the receiver's 30 dB of C/A processing gain, the jammer is still 13.6 dB above the processed signal. The GPS receiver cannot acquire or track the satellite.

Scale this up. A 10-watt jammer at the same range would yield J/S of 53.6 dB. At 50 km range, the same 1-watt jammer still delivers a J/S of roughly 29.6 dB, enough to deny acquisition of C/A code signals. The effective jamming radius depends on terrain, antenna patterns, and the receiver's anti-jam features, but the basic physics guarantee that even modest ground-based jammers create denial zones measured in tens of kilometres.

Types of Jamming Waveforms

Continuous wave (CW) jamming places a single tone at or near the GPS carrier frequency. A CW jammer is trivially simple to build: it is just an oscillator and an amplifier. Against a spread spectrum system, a CW jammer is relatively inefficient because the receiver's correlator spreads the jammer's energy across the code bandwidth, providing some suppression. A CW jammer must be roughly 30 dB stronger relative to the GPS signal than a matched-bandwidth noise jammer to achieve the same effect. Still, the extreme weakness of the GPS signal means that even inefficient jamming works at short range.

Swept CW jamming moves the CW tone across the GPS band, typically covering 10 to 20 MHz centred on L1. This catches frequency-agile processing and is more effective than a static CW tone because it periodically passes through whatever frequency bin the receiver is correlating.

Broadband noise jamming transmits Gaussian noise across the entire GPS L1 band (approximately 20 MHz for C/A, wider for P(Y)). This is the most spectrally efficient jamming waveform against spread spectrum: the noise looks just like elevated thermal noise to the receiver, and the correlator gains no advantage from despreading. The jammer needs only to raise the effective noise floor above the post-correlation signal level. The required J/S for effective broadband noise jamming against C/A code is roughly 0 dB after processing gain, meaning the raw J/S needs to be about 30 dB.

Pulsed jamming transmits high-power bursts that saturate the receiver's analogue front end and AGC. Between pulses, the receiver may recover partially, but the effective duty cycle of the jammer determines the average degradation. Pulsed jamming is particularly effective against receivers with slow AGC recovery times.

Commercial GPS Jammers

Despite being illegal throughout the European Union under the Radio Equipment Directive (2014/53/EU) and in most other jurisdictions, personal GPS jammers are widely available on grey-market websites for as little as €30. These devices are marketed as "personal privacy devices" to drivers who want to defeat fleet tracking systems installed by their employers. A typical unit is powered from a 12V cigarette lighter socket, fits in a palm, and transmits 10 to 500 milliwatts across L1 (and often L2 and L5 simultaneously).

At 100 milliwatts and 50 metres range, such a jammer produces J/S of roughly 70 dB. Within a vehicle, it reliably denies GPS to the vehicle's tracking unit. The problem is that the signal radiates omnidirectionally, creating a jamming bubble around the vehicle that affects every GPS receiver within range. In 2013, a truck driver operating a personal jammer drove past Newark Liberty International Airport in the United States daily, causing repeated disruptions to the airport's ground-based augmentation system (GBAS). The jammer was eventually located through direction-finding equipment operated by the Federal Communications Commission. Similar incidents have been documented across Europe, including disruptions to port operations in the Netherlands and timing systems at telecommunications sites in the United Kingdom.

Military Jammers

Military GPS jamming operates at a completely different scale. Systems like the Russian R-330Zh Zhitel are vehicle-mounted electronic warfare platforms capable of jamming GPS, GLONASS, and other GNSS signals over areas measured in hundreds of kilometres. The Zhitel system, which has been identified operating in eastern Ukraine and Syria, is mounted on a Kamaz truck chassis and includes directional antennas that can target specific sectors. Its effective jamming range against civilian GPS receivers is reported to exceed 150 km under favourable conditions.

Russia's Pole-21 system takes a different approach: it integrates GPS jamming modules into existing cellular tower infrastructure, creating a distributed jamming network that covers large areas without requiring dedicated EW vehicles. Multiple Pole-21 units operating across a defended area create overlapping denial zones that are difficult to suppress through targeting individual nodes.

On the expendable side, the concept of GPS jamming rounds has been explored by several militaries. These are artillery-delivered or air-dropped devices that activate on landing and transmit GPS jamming signals for a predetermined duration, creating temporary denial zones over a battlefield. The small form factor limits transmit power, but at ground level within a few kilometres, even milliwatt-class jammers are effective.

The Eastern Mediterranean: GPS Spoofing at Scale

Since late 2018, pilots flying in the eastern Mediterranean have reported persistent and severe GPS anomalies. Aircraft approaching Larnaca (Cyprus), Beirut, and Tel Aviv have received GPS positions indicating they are located at airports hundreds of kilometres from their actual position. In several documented cases, aircraft on approach to Larnaca received GPS positions placing them at Beirut Rafic Hariri International Airport, roughly 200 km to the east. Other reports placed aircraft at locations in northern Syria, southern Turkey, or in the middle of the sea.

Eurocontrol, the European Organisation for the Safety of Air Navigation, documented these events in a series of advisories and technical papers beginning in 2019. Their analysis of ADS-B (Automatic Dependent Surveillance-Broadcast) data revealed clear signatures distinguishing spoofing from jamming. When an aircraft is jammed, its ADS-B transmissions either cease (if the GPS receiver loses lock entirely) or show increasing position uncertainty flags. When an aircraft is spoofed, its ADS-B transmissions show a sudden, coherent jump to a false position, often with good reported accuracy (low NACp values), because the receiver believes it has a valid fix.

The technical community has widely attributed these disruptions to military electronic warfare operations by Israel, though Israeli authorities have not confirmed this. The spoofing pattern is consistent with a ground-based system designed to protect against GPS-guided munitions and UAVs, and the affected area correlates with regions of active military operations. The system appears to transmit GPS signals that encode position data for one or more specific airports, causing receivers to compute positions at those airports regardless of their actual location. This technique is sometimes called "location spoofing to a known point," and it is optimised for simplicity rather than subtlety: the goal is to deny GPS navigation to incoming threats, not to deceive individual receivers with plausible false trajectories.

The scale of the disruption has been remarkable. By 2024, Eurocontrol had documented over 50,000 instances of GPS interference affecting civil aviation in the region. The IATA (International Air Transport Association) issued guidance requiring airlines operating in the affected area to ensure that crews could navigate using VOR/DME and inertial references when GPS became unreliable. For civil aviation, the primary risk is not that aircraft will fly to the wrong location (pilots cross-check GPS against other navigation aids), but that GPS-dependent approach procedures become unavailable, forcing diverts or delays.

Similar GPS disruption patterns have been observed in the Baltic region, with Finland, Estonia, and Poland all reporting significant GPS interference that aviation authorities attributed to Russian electronic warfare systems operating from Kaliningrad and the St. Petersburg region. In December 2023, a rash of GPS spoofing events over the Baltic redirected aircraft position solutions to points in the Middle East and North Africa, suggesting the use of meaconing or replay equipment configured for a different theatre.

GPS Spoofing in Detail

GPS spoofing is the transmission of counterfeit GPS signals intended to cause a receiver to compute an incorrect position, velocity, or time solution. Unlike jamming, which denies navigation by overwhelming the receiver, spoofing deceives the receiver into trusting false information. This makes spoofing potentially more dangerous: a jammed receiver knows it has lost GPS and can alert the operator, while a spoofed receiver may report a confident but wrong position.

Meaconing

The simplest form of spoofing is meaconing: receiving real GPS signals, amplifying them, and rebroadcasting them with a delay. The delay introduces a range error into every pseudorange measurement at the victim receiver. If all signals are delayed equally, the effect is a time offset rather than a position offset. If the meaconer introduces differential delays across satellite signals (using separate receive/transmit chains for each satellite), it can induce controlled position errors.

Meaconing has the advantage of not requiring any knowledge of the GPS signal structure or encryption. Since the rebroadcast signals are genuine GPS signals, they pass all integrity checks, including P(Y) code authentication. The disadvantage is limited control: the attacker cannot place the victim at an arbitrary position, only induce errors proportional to the introduced delays. Meaconing is also detectable by receivers that monitor carrier phase consistency across time, since the rebroadcast signals travel a different physical path than the direct satellite signals.

Simplistic C/A Code Spoofing

Because the C/A code structure is fully public (published in the GPS Interface Control Document IS-GPS-200), anyone with a software-defined radio and appropriate software can generate signals that are indistinguishable from real GPS C/A transmissions. Open-source GPS signal simulators capable of generating realistic L1 C/A signals have been available for years. A BladeRF or HackRF One SDR (costing €300 to €500) paired with open-source code can produce GPS signals encoding any desired position, velocity, and time.

A simplistic spoofing attack transmits these counterfeit signals at a power level high enough to overpower the real GPS signals. The receiver's correlator locks onto the stronger counterfeit signals and computes whatever position the attacker encodes. This works reliably against any receiver using only C/A code, which includes all civilian receivers and most consumer devices.

The weakness of simplistic spoofing is the transition. If the victim receiver is already tracking real GPS signals, the sudden appearance of much stronger signals on the same PRN codes may cause the receiver to lose lock temporarily, producing a detectable disruption. Sophisticated spoofing addresses this.

Sophisticated Spoofing: The Lift-Off Attack

A sophisticated spoofing attack proceeds through four phases, sometimes called the spoofing kill chain:

Phase 1: Reconnaissance. The attacker estimates the victim's approximate position (from open-source intelligence, observation, or prior surveillance) and determines which GPS satellites the victim can see. The attacker also estimates the victim's receiver clock bias if possible.

Phase 2: Alignment. The attacker generates counterfeit signals that initially replicate the real GPS signals as seen by the victim. The code phase, carrier frequency (including Doppler), and navigation data of each counterfeit signal must match the real signals to within the receiver's tracking loop bandwidth. This requires the attacker to have their own GPS receiver at or near the victim's location to measure the real signal parameters.

Phase 3: Takeover. The attacker gradually increases the power of the counterfeit signals until they overpower the authentic signals. Because the counterfeit signals are code-phase-aligned with the real ones, the receiver's tracking loops smoothly transfer from real to counterfeit without losing lock. There is no detectable discontinuity. The receiver is now tracking the attacker's signals.

Phase 4: Manipulation. The attacker slowly adjusts the code phase, carrier frequency, and navigation data of the counterfeit signals to drag the receiver's position solution away from the true position. The rate of change must stay within the receiver's tracking loop dynamics to avoid triggering carrier-lock or code-lock alarms. A typical manipulation rate of 1 to 10 metres per second is usually sufficient for gradual displacement while remaining within normal dynamics.

This attack was demonstrated publicly by Professor Todd Humphreys' group at the University of Texas at Austin in 2012, when they spoofed the GPS receiver on a yacht in the Mediterranean. The yacht's navigation system reported a false position while the crew noticed nothing unusual.

Why P(Y) Code Resists Spoofing (Partially)

The P(Y) code is encrypted using the W-code, which is classified. Without the encryption keys, an attacker cannot generate valid P(Y) code signals. A receiver tracking P(Y) code will reject counterfeit signals that do not carry correct encryption. This provides anti-spoofing protection for military receivers with access to the cryptographic keys.

However, P(Y) code anti-spoofing has limitations. The receiver must already be tracking P(Y) to benefit from it, and initial acquisition of P(Y) typically requires first acquiring C/A code (which is spoofable) and then handing off. An attacker who can spoof the C/A code during initial acquisition may be able to prevent the receiver from ever acquiring P(Y). Additionally, P(Y) can still be jammed (encryption does not protect against noise jamming), and meaconing attacks work against P(Y) since the rebroadcast signals carry valid encryption.

Military Hardening: M-Code and SAASM

The limitations of P(Y) code anti-spoofing motivated the development of M-code, the modernised military GPS signal that represents the most significant upgrade to GPS military capability since the system became operational.

M-code Signal Design

M-code uses a Binary Offset Carrier modulation, specifically BOC(10,5), which splits the signal energy into two lobes symmetrically offset from the L1 and L2 carrier frequencies. This spectral separation serves multiple purposes: it avoids interference with existing C/A and P(Y) signals on the same carriers, it provides a wider bandwidth that improves resistance to narrowband jamming, and it allows the M-code correlator to operate independently of C/A code, enabling direct acquisition of M-code without first acquiring the civilian signal.

Direct acquisition is critical. One of the weaknesses of the legacy military signal architecture was that P(Y) code acquisition typically depended on C/A code. If an adversary spoofed or jammed C/A, the military receiver might never reach P(Y). M-code eliminates this dependency: a military receiver can acquire M-code directly using only the classified encryption keys, bypassing C/A entirely.

The M-code spreading code is generated using a classified encryption algorithm. Without the key, the code appears as random noise with no detectable structure. An attacker cannot generate valid M-code signals, cannot predict the code sequence, and cannot even determine whether a given signal contains M-code or is simply noise. This makes spoofing M-code computationally infeasible with current technology.

Spot Beams on GPS III

GPS III satellites, built by Lockheed Martin, introduce a high-power spot beam capability for M-code. Legacy GPS satellites transmit M-code through the same Earth-coverage antenna used for all signals, yielding a received power of approximately -128 dBm. GPS III can direct M-code through a steerable high-gain antenna that concentrates power into a spot beam covering a specific geographic region. The spot beam delivers roughly 20 dB more power than the Earth-coverage antenna, raising the received M-code power to approximately -108 dBm.

This 20 dB increase has a direct effect on jam resistance. A jammer that would overpower the standard M-code signal now needs 100 times more power (20 dB) to achieve the same J/S against the spot beam signal. Alternatively, the jammer's effective range is reduced by a factor of 10. In operational terms, a spot beam activated over a theatre of operations can burn through moderate jamming environments that would deny the standard signal.

As of early 2026, 10 GPS III satellites are operational, with additional GPS III and GPS IIIF (Follow On) satellites in production. Full M-code operational capability (FOC) requires both a sufficient constellation of M-code-capable satellites and the fielding of military user equipment (receivers) capable of processing M-code. The Military GPS User Equipment (MGUE) programme, managed by the US Space Force, is developing the next generation of M-code-capable receivers.

SAASM Receivers

The Selective Availability Anti-Spoofing Module (SAASM) is the current-generation security architecture for military GPS receivers. SAASM receivers contain a tamper-resistant cryptographic module that stores the keys needed to decrypt P(Y) code and M-code. The keys are loaded through a secure key distribution process and are zeroised (erased) if the module detects tampering.

Systems that incorporate SAASM include the Defence Advanced GPS Receiver (DAGR), built by Rockwell Collins (now Collins Aerospace, a division of RTX), which is the standard handheld military GPS receiver for US and allied forces. The DAGR receives L1/L2 P(Y) code and provides position accuracy of approximately 1 metre SEP (Spherical Error Probable). It is being replaced by the MGUE Increment 1 receiver, which adds M-code capability. European NATO allies use a mix of DAGR units and nationally developed SAASM-equivalent receivers, though the cryptographic keys remain under US control, a fact that has motivated European investment in independent systems.

Anti-Jam Antennas: Spatial Filtering with CRPAs

Even with M-code's improved jam resistance, a sufficiently powerful jammer at close range can still overwhelm the receiver. The next layer of defence is the antenna, specifically, the Controlled Reception Pattern Antenna (CRPA), which uses spatial filtering to suppress jamming signals while preserving GPS satellite signals.

The Concept

A conventional GPS antenna (a single patch element) receives signals from all directions. It has no ability to distinguish between a satellite signal arriving from 45 degrees elevation and a jammer signal arriving from the horizon. A CRPA uses multiple antenna elements arranged in an array (7 elements is a common configuration, arranged in a hexagonal pattern), each connected to its own receiver chain. By adjusting the amplitude and phase weighting applied to each element, the system can shape the antenna's radiation pattern in real time, forming nulls (directions of very low gain) toward jammers and maintaining gain toward satellites.

The mathematical basis is beamforming. For a seven-element array, the system has six degrees of freedom (one element serves as the reference). Each degree of freedom can place one null in a specific direction. In principle, a seven-element CRPA can simultaneously null six independent jammers. In practice, factors like element spacing (typically half a wavelength at L1, about 9.5 cm), mutual coupling, and bandwidth limitations reduce this somewhat, but four to five simultaneous nulls are routinely achievable.

Null Depth and Jam Suppression

The null depth achievable by a well-calibrated CRPA array is typically 30 to 50 dB. This means a jammer signal arriving from a direction where the array has placed a null is attenuated by 30 to 50 dB before it reaches the correlator. Combined with the 30 dB of spread spectrum processing gain, a CRPA-equipped receiver can operate in jammer-to-signal environments exceeding 60 to 80 dB.

To put this in operational terms: if a 10-watt jammer at 5 km range produces J/S of roughly 60 dB against a standard antenna, a CRPA with 40 dB null depth reduces this to an effective J/S of 20 dB. After 30 dB of spread spectrum processing gain, the signal is 10 dB above the jammer, and the receiver operates normally. The same jammer would need to move to within a few hundred metres, or increase power to several kilowatts, to overcome the CRPA.

Digital Beamforming and Space-Time Adaptive Processing

Modern CRPAs use digital beamforming: each element's signal is independently digitised, and the beamforming weights are computed digitally. This allows rapid adaptation (updating weights at kilohertz rates) to respond to moving jammers or multiple jammers activating sequentially.

Space-Time Adaptive Processing (STAP) extends this concept by applying adaptive filtering in both the spatial domain (across antenna elements) and the temporal domain (across time samples). STAP can suppress jammers that would be difficult to null spatially alone, such as wideband jammers or jammers at nearly the same azimuth as a satellite. STAP algorithms are computationally expensive but increasingly feasible with modern FPGA and GPU hardware.

Fielded Systems

BAE Systems manufactures the Digital Anti-Jam Receiver (DIGAR) and associated CRPA systems used on US military aircraft and vehicles. The seven-element CRPA from BAE provides GPS anti-jam protection with demonstrated null depths exceeding 40 dB.

L3Harris produces the EAGLE (Enhanced Anti-jam GPS Lightweight Equipment) receiver, which integrates M-code processing with CRPA beamforming for ground vehicles. Raytheon (RTX) offers GPS anti-jam solutions for precision-guided munitions, where the antenna system must be small enough to fit within a weapon body.

In Europe, Thales produces GPS/Galileo anti-jam receivers for French military platforms, and Airbus Defence and Space has developed CRPA-based solutions for the Eurofighter Typhoon and other European aircraft. These European systems often integrate both GPS and Galileo signals, providing multi-constellation resilience.

Galileo and European Navigation Independence

Europe's Galileo constellation provides an independent global navigation capability that is not subject to US government control. This independence is not merely political: it provides a concrete technical hedge against scenarios where GPS is degraded, denied, or intentionally restricted.

Public Regulated Service (PRS)

Galileo's Public Regulated Service is the European equivalent (roughly) of GPS M-code. PRS provides encrypted, robust navigation signals on two frequencies (E1 at 1575.42 MHz and E6 at 1278.75 MHz) intended for government-authorised users including military forces, police, customs, and critical infrastructure operators. The PRS signal uses an encrypted spreading code and encrypted navigation message. Without the cryptographic keys, which are managed by each EU member state's Competent PRS Authority, the signals cannot be acquired, tracked, or spoofed.

PRS is designed for jam resistance. It uses BOC(15,2.5) modulation on E1 and BOC-cosine(10,5) on E6, providing wider bandwidth than the Galileo Open Service signals and therefore greater processing gain against narrowband jamming. The dual-frequency design also provides ionospheric correction and an additional layer of resilience: an adversary must jam both E1 and E6 to deny PRS, and those frequencies are separated by nearly 300 MHz.

As of 2026, PRS initial services have been declared, and EU member states are deploying PRS receivers to government and military users. The French armed forces, the Italian Carabinieri, and Spanish law enforcement agencies are among the early operational users. PRS receivers are being developed by European companies including Thales, Airbus, and Septentrio.

Open Service Navigation Message Authentication (OSNMA)

For civilian users, Galileo introduced OSNMA, a system that digitally signs the navigation message broadcast on the Open Service frequencies. The receiver can verify the signature using publicly available keys, confirming that the navigation message was generated by a Galileo satellite and has not been tampered with. OSNMA does not encrypt the ranging codes (so the signal structure remains public), but it authenticates the navigation data, making it significantly harder to spoof.

OSNMA works by including a digital signature (based on TESLA, a delayed-disclosure authentication protocol) in the navigation message. The receiver buffers the navigation data and the signature, waits for the key disclosure (which occurs after a short delay), then verifies the signature. If verification fails, the receiver flags the signal as potentially spoofed. The authentication latency is on the order of seconds to tens of seconds, which is acceptable for most applications but not for safety-of-life services requiring real-time integrity.

Galileo OSNMA reached initial operational status in early 2025, making Galileo the first GNSS constellation to provide civilian anti-spoofing authentication as a standard service. GPS has announced plans for a similar capability (CHIMERA, Chips-Message Robust Authentication) but it has not yet been operationally deployed.

Multi-Constellation Resilience

The ability to receive both GPS and Galileo (and potentially GLONASS and BeiDou) provides inherent resilience against single-constellation attacks. A jammer designed to deny GPS L1 may not cover the Galileo E5a frequency (1176.45 MHz) or E6 (1278.75 MHz). A spoofer generating counterfeit GPS C/A code signals provides no counterfeit Galileo signals. A receiver that cross-checks position solutions from GPS and Galileo independently can detect inconsistencies that indicate spoofing or selective jamming. European military receivers increasingly exploit this multi-constellation advantage.

Inertial Navigation: The Un-Jammable Fallback

When all satellite signals are denied, whether by jamming, spoofing, or simply operating underground or in a deep urban canyon, inertial navigation provides autonomous positioning that depends on no external signal. An inertial measurement unit (IMU) contains accelerometers and gyroscopes that measure the vehicle's specific force and angular rate. By integrating these measurements over time from a known starting position (a process called dead reckoning or strapdown inertial navigation), the system computes a continuous position, velocity, and attitude solution.

The physics are simple in principle. An accelerometer measures acceleration. Integrate acceleration once to get velocity. Integrate velocity to get position. A gyroscope measures rotation rate. Integrate rotation rate to get attitude (orientation). The INS uses the attitude solution to rotate the accelerometer measurements from body coordinates to navigation coordinates (Earth-fixed), then integrates to get velocity and position.

The challenge is error accumulation. Every sensor has bias, scale factor error, and noise. These errors integrate over time, causing the position solution to drift. The drift rate depends on the sensor grade.

Sensor Grades

Navigation-grade INS units, used on submarines, intercontinental ballistic missiles, and strategic aircraft, use ring laser gyroscopes (RLGs) or high-performance fibre-optic gyroscopes (FOGs). A navigation-grade RLG has a bias stability of approximately 0.003 to 0.01 degrees per hour. The corresponding position drift after one hour of unaided operation (no GPS) is roughly 0.5 to 1.8 kilometres, depending on the specific sensors and the quality of the initial alignment. The Honeywell H-764G, used on numerous European and NATO aircraft, is a navigation-grade INS that achieves position accuracy of better than 0.8 nautical miles per hour (about 1.5 km/hr) of free-inertial operation.

The Northrop Grumman LN-251 is another widely used navigation-grade INS, deployed on the Eurofighter Typhoon, NH90 helicopter, and various naval platforms. It uses a fibre-optic gyroscope assembly and provides free-inertial accuracy comparable to the H-764G.

Tactical-grade INS units use lower-cost FOGs or high-end MEMS sensors with gyroscope bias stability of roughly 0.1 to 1 degree per hour. Position drift is on the order of 5 to 20 km per hour. Tactical INS units are used on guided munitions, UAVs, and ground vehicles where cost and size constraints preclude navigation-grade hardware. The iXblue (now Exail) MARINS series and the Safran Geonyx are examples of European tactical-grade INS units.

MEMS-grade IMUs, found in smartphones, consumer drones, and low-cost military applications, have gyroscope bias stability of 1 to 100 degrees per hour. A MEMS IMU loses useful navigation accuracy within minutes of GPS loss. However, MEMS technology is improving rapidly: the latest automotive-grade MEMS IMUs from Bosch and STMicroelectronics achieve bias stability below 1 deg/hr, approaching tactical grade.

GPS/INS Integration: Kalman Filters and Tight Coupling

In practice, no military platform relies on GPS alone or INS alone. The two systems are integrated using estimation algorithms, almost universally a Kalman filter or one of its variants (Extended Kalman Filter, Unscented Kalman Filter).

The Kalman filter maintains a state vector that includes position, velocity, attitude, and crucially, the INS sensor errors (accelerometer biases, gyroscope biases, scale factors). When GPS measurements are available, the filter uses them to estimate and correct these sensor errors. When GPS is lost, the filter continues propagating the state using INS alone, but now with calibrated sensor errors. This means the INS drifts much more slowly after GPS loss than it would have from a cold start, because the biases were estimated and removed during the period of GPS availability.

Loosely coupled integration feeds the GPS receiver's position and velocity solution into the Kalman filter as measurements. The GPS receiver operates independently and provides a complete navigation solution. This is simple but breaks down when the GPS receiver loses lock, because no measurements are available to the filter.

Tightly coupled integration feeds raw GPS pseudoranges and Doppler measurements into the Kalman filter, which estimates both the INS errors and the GPS receiver clock bias. The advantage is that the filter can use measurements from individual satellites even when fewer than four are available (which would prevent a standalone GPS position fix). In a jamming environment where three of eight satellites are still trackable, a tightly coupled system can use those three pseudoranges to constrain the INS drift, even though a standalone GPS receiver would report "no fix."

Ultra-tight (deeply coupled) integration goes further, embedding the INS solution into the GPS receiver's tracking loops. The INS-predicted pseudorange and Doppler are used to narrow the search space for each satellite's signal, allowing the receiver to maintain track at much lower signal-to-noise ratios. This provides the maximum resistance to jamming: the receiver can track GPS signals that are 10 to 20 dB weaker than what a standalone receiver requires, because the INS prediction removes most of the uncertainty in code phase and carrier frequency.

Coasting Performance

How long can a GPS/INS system coast after GPS loss? For a navigation-grade tightly coupled system that has been operating with GPS for at least 15 to 20 minutes (enough time for the Kalman filter to converge on the gyro biases), the position error after one hour of GPS denial is typically 1 to 2 kilometres. After 10 minutes, the error is often below 200 metres. For a tactical-grade system, one hour of coasting yields 5 to 20 km of error, and useful tactical accuracy (sub-100 metre) is maintained for perhaps 5 to 10 minutes.

These numbers matter operationally. An aircraft penetrating a GPS-denied zone at 800 km/hr traverses 100 km in 7.5 minutes. A navigation-grade INS, well-calibrated by GPS before entry, maintains accuracy of a few hundred metres throughout that transit. For most military tasks, this is sufficient. The GPS/INS architecture is designed around exactly this operational concept: use GPS to calibrate the INS continuously during transit, then coast on INS through the denied zone.

Alternative Navigation Technologies

Even with GPS/INS integration, military planners want additional layers of resilience. Several technologies provide position information without satellite signals.

Terrain-Referenced Navigation (TERCOM)

TERCOM compares radar altimeter measurements of terrain elevation against a stored digital terrain map. As the vehicle flies over known terrain, the sequence of altitude measurements forms a profile that can be correlated with the map to determine position. TERCOM was developed in the 1970s for cruise missiles (it guided the original BGM-109 Tomahawk) and remains in use on modern cruise missiles and some aircraft.

The accuracy of TERCOM depends on terrain roughness and map quality. Over mountainous terrain with distinctive features, TERCOM can achieve position fixes of 50 to 100 metres. Over flat terrain (deserts, open ocean), it is useless. TERCOM is also limited to low-altitude flight where the radar altimeter can resolve terrain features.

The European missile manufacturer MBDA uses TERCOM in the Storm Shadow/SCALP EG cruise missile, alongside GPS/INS and a terminal imaging infrared seeker. The integration of TERCOM with INS corrects the inertial drift accumulated during flight, providing the accuracy needed for the terminal guidance phase.

Celestial Navigation

Automated celestial navigation, using star trackers to determine position from star observations, is used on ballistic missiles, some cruise missiles, and strategic aircraft. A star tracker is a camera pointed at the sky through a window, with image processing that identifies known stars and computes the vehicle's latitude and longitude from the measured star positions. Accuracy is typically 50 to 200 metres, limited by atmospheric refraction and the accuracy of the vehicle's attitude reference.

The Northrop Grumman Astro-Inertial Navigation System, used on the B-2 Spirit bomber, combines a stellar sensor with a navigation-grade INS. The star tracker provides periodic position fixes that bound the INS drift, similar to how GPS does, but using stars instead of satellites. The system is completely passive (it only receives light, transmitting nothing), cannot be jammed or spoofed, and works anywhere the sky is visible.

Visual Odometry and SLAM

Small military UAVs increasingly use visual odometry and Simultaneous Localisation and Mapping (SLAM) algorithms to navigate in GPS-denied environments. A downward-looking camera tracks features on the ground between frames, computing the vehicle's displacement from the observed feature motion. This is equivalent to optical flow measurement, and when combined with an IMU, provides a velocity estimate that can constrain the INS drift.

Visual SLAM extends this by building a map of the environment in real time, then localising the vehicle within that map. Lidar SLAM (using a laser scanner instead of a camera) is more robust to lighting conditions and provides 3D mapping. Both techniques are used on military ground robots and indoor reconnaissance drones where satellite navigation is unavailable.

Signals of Opportunity

Any signal with known transmitter location and predictable characteristics can, in principle, be used for positioning. Researchers and military developers have demonstrated navigation using FM radio broadcasts, DAB (Digital Audio Broadcasting) signals, LTE cellular signals, and even Wi-Fi. The concept is pseudoranging: measure the time of arrival of a signal from a transmitter at a known location, compute the range, and trilaterate.

LTE signals are particularly promising for urban military operations. LTE base stations are densely deployed, transmit at powers of 20 to 40 watts, and broadcast synchronisation signals with microsecond-level timing precision. A receiver that knows the locations of nearby base stations and can measure time-of-arrival differences can compute a position fix with accuracy of 50 to 200 metres, depending on geometry and multipath conditions. BAE Systems and several European defence research organisations (including TNO in the Netherlands and Fraunhofer FKIE in Germany) have demonstrated navigation using signals of opportunity in GPS-denied urban environments.

eLoran

Enhanced Loran (eLoran) is a ground-based, low-frequency (100 kHz) navigation system that provides an independent backup to GNSS. The eLoran signal is transmitted at very high power (hundreds of kilowatts) from ground stations, propagates via surface wave with excellent coverage over land and coastal waters, and is inherently resistant to the jamming techniques used against GNSS (the frequency is far removed from the L-band, and the high received signal power requires enormous jammer power to overcome).

The United Kingdom operated an eLoran testbed from the Anthorn transmitter in Cumbria through the mid-2010s, and the General Lighthouse Authorities of the UK and Ireland evaluated eLoran as a maritime backup to GPS with demonstrated accuracy of 10 to 20 metres. Continental European interest in eLoran has grown following the GPS disruptions in the Baltic and eastern Mediterranean. South Korea operates a full eLoran system covering the Korean Peninsula, and there have been proposals for a pan-European eLoran network, though funding and political will have been inconsistent.

The eLoran signal structure includes a data channel that can carry differential corrections (improving accuracy to below 10 metres), integrity information, and authenticated messages. The authentication capability is significant: it provides a degree of anti-spoofing protection that civilian GPS lacks.

The Navigation Warfare Landscape

Navigation warfare, the contest between GPS denial and GPS resilience, has become a defining feature of modern military operations. The experiences in Ukraine, Syria, and the eastern Mediterranean have demonstrated that GPS denial is not a theoretical future threat but an operational reality that affects both military and civilian users today.

Russian Capabilities

Russia has invested heavily in GPS/GNSS denial capabilities at multiple scales. At the strategic level, systems like the Murmansk-BN (designed primarily for communications jamming but with GNSS denial capability) and the Pole-21 distributed jammer network provide area denial over hundreds of kilometres. At the operational level, the R-330Zh Zhitel and the newer Tirada-2 provide mobile GNSS jamming for manoeuvre units. At the tactical level, Russian forces have deployed GPS jamming modules on individual vehicles and even on some infantry electronic warfare kits.

The war in Ukraine has provided the most extensive operational data on GPS warfare. Both sides have experienced significant GPS degradation. Ukrainian operators reported that GPS-guided munitions (including converted JDAM-ER bombs and GMLRS rockets) have experienced reduced accuracy in areas covered by Russian electronic warfare systems. The Russian Volga-based GPS jamming systems reportedly reduced the circular error probable (CEP) of some GPS-guided weapons from under 10 metres to hundreds of metres in heavily contested areas.

Conversely, Ukrainian electronic warfare units have jammed Russian GLONASS signals to degrade the accuracy of Russian precision munitions, with the Lancet loitering munition and various GPS/GLONASS-guided bombs being reported targets of such efforts.

Chinese Capabilities

China has developed its own suite of GNSS denial systems, though less operational data is publicly available. Chinese military doctrine emphasises "systems destruction warfare," which includes degrading adversary navigation and timing systems as a key objective. China has demonstrated GPS/GNSS jamming capabilities during exercises in the South China Sea, where commercial shipping and aircraft have reported GPS disruptions attributed to Chinese military activity. China also operates its own BeiDou GNSS constellation, which provides an independent navigation capability for Chinese forces, reducing their own vulnerability to GPS denial by external actors.

NATO Resilient PNT Strategy

NATO's response to the GPS denial threat is organised around the concept of resilient Positioning, Navigation, and Timing (PNT). The NATO Communications and Information Agency (NCIA) has published requirements for resilient PNT architectures that include multi-constellation GNSS reception (GPS, Galileo, and potentially GLONASS/BeiDou for monitoring), anti-jam antenna systems, tightly coupled GPS/INS integration, and alternative navigation sources including TERCOM and signals of opportunity.

The European Defence Agency (EDA) has funded research programmes on GPS/Galileo PRS integration, CRPA development, and alternative navigation for military platforms. The EDA's MENTOR programme specifically addresses the integration of Galileo PRS with GPS M-code for European military users, aiming to provide a dual-constellation encrypted navigation capability that is significantly harder to deny than either system alone.

At the national level, France, Germany, Italy, and the United Kingdom have all invested in indigenous resilient PNT capabilities. France's Direction Generale de l'Armement (DGA) has funded Safran and Thales to develop next-generation GPS/Galileo/INS systems for the Rafale fighter and Leclerc tank. Germany's Bundeswehr has fielded Airbus-developed anti-jam GPS/Galileo receivers on its armoured vehicles. The UK Ministry of Defence has invested in eLoran evaluation, CRPA development (through QinetiQ and BAE Systems), and tightly coupled GPS/INS systems for precision-guided munitions.

The Timing Dimension

GPS denial is not only a navigation problem. GPS provides a precise timing reference (accurate to tens of nanoseconds) that underpins telecommunications networks, power grid synchronisation, financial transaction timestamping, and scientific measurements across Europe and globally. A large-scale GPS jamming event affecting a major European city would disrupt cellular network synchronisation within hours (LTE and 5G base stations rely on GPS timing to maintain frame synchronisation), degrade power grid phase measurement units that utilities use to monitor grid stability, and potentially affect financial exchanges.

European telecommunications regulators and power grid operators are increasingly aware of this dependency. The European Telecommunications Standards Institute (ETSI) has published guidelines on GNSS timing resilience for telecom operators. Several European mobile operators have deployed holdover oscillators (rubidium or chip-scale caesium clocks) at critical base stations, allowing them to maintain timing accuracy for hours to days after GPS loss. The cost is substantial (€5,000 to €15,000 per holdover oscillator), but the consequence of synchronisation loss, dropped calls, degraded data throughput, and potential network cascading failures, justifies the investment.

Conclusion

GPS denial and spoofing exploit a fundamental asymmetry: a signal that has travelled 20,200 km is trivially overpowered by a transmitter on the ground. No amount of signal design can fully overcome the physics of free-space path loss over such distances. The engineering response is layered defence: encrypted signals (M-code, Galileo PRS) that cannot be forged, high-power spot beams that narrow the power gap, spatial filtering through CRPA antennas that suppress jammers by 30 to 50 dB, inertial navigation that operates independently of all external signals, and alternative navigation technologies that provide redundancy through diversity.

The experiences of the past several years, particularly in Ukraine, Syria, and the eastern Mediterranean, have demonstrated that GPS denial is an operational reality, not a theoretical concern. Military systems that depend solely on unprotected GPS are vulnerable. Civilian systems that depend solely on GPS for navigation and timing are fragile. The path forward is multi-layered, multi-constellation, and multi-phenomenology: GPS plus Galileo plus INS plus terrain matching plus signals of opportunity, with authenticated signals (OSNMA, PRS) providing anti-spoofing protection that raw C/A code never can.

The physics of the problem are clear. A one-watt jammer at 10 km produces 43 dB of jammer-to-signal advantage over a GPS satellite 20,200 km away. No single countermeasure erases that advantage completely. But a CRPA that nulls the jammer by 40 dB, combined with M-code's additional processing gain and a spot beam's 20 dB power increase, transforms an impossible situation into a manageable one. Add a navigation-grade INS that can coast for an hour with sub-2 km accuracy, and the military user can operate through GPS denial zones that would paralyse an unprotected receiver. The engineering is real, the systems are fielded, and the contest between denial and resilience will define navigation warfare for the coming decades.