Editor’s Note: ‘The prudent mariner will use every means at their disposal to determine their position’ is an axiom that dates back to the age of sail. But what if you only have one means to determine your position? The below was published yesterday on the website for Maritime Executive Magazine. See our note after the below.
The Maritime Executive
How to Steal a Ship
In 2013, Professor Todd Humphries of the University of Texas made news by demonstrating how he could “takeover” navigation of a large yacht by co-opting its navigation system with false GPS signals. Even though the captain and crew knew what was going to happen, the vessel was out of sight of land and the changes in course were too subtle for them to detect.
In the most recent edition of the Institute of Navigation’s Journal “Navigation” Professor Humphries and a colleague explain over the course of 16 pages how it was done. From the paper’s abstract:
“An attacker’s ability to control a maritime surface vessel by broadcasting counterfeit civil Global Positioning System (GPS) signals is analyzed and demonstrated. The aim of this work is to explore civil maritime transportation’s vulnerability to deceptive GPS signals and to develop a detection technique that is compatible with sensors commonly available on modern ships. It is shown that despite access to a variety of high-quality navigation and surveillance sensors, modern maritime navigation depends crucially on satellite navigation and that a deception attack can be disguised as the effects of slowly-changing ocean currents …”
But bad actors need not be able to penetrate the complex formulas of this technical paper in order to pose a significant hazard to shipping. At the annual Defcon hackers’ convention in 2015 a Chinese technologist gave step by step instructions on how to build a GPS spoofing device and was selling kits for $300.
Maritime executives and security professionals should take note.
Imagine a container ship bound from the Cape of Good Hope to Osaka via the Malacca Strait. A crew member or paying passenger has brought a GPS spoofing device aboard that is difficult to distinguish from a computer or other piece of personal electronics.
Once the ship is well clear of Africa and Madagascar, the spoofer diverts the ship’s course slightly more than five degrees to the right and encourages an speed increase of two knots. In less than four days, instead of arriving at the entrance to the Malacca Straits as expected, the vessel will make landfall 10 hours earlier and 220 nautical miles away, off shore a sparsely populated part of Indonesia.
Dana A. Goward is President of Resilient Navigation and Timing Foundation.
Link to article in Maritime Executive
Editor’s End Note: There are many things that can be done by mariners, companies and nations to greatly reduce the opportunities for scenarios like the one described above. Professor Humphries and his coauthor describe some in his journal paper. Supplementing GPS/GNSS signals with terrestrial signals is another way. For example, many vessels in Europe and the northern Atlantic could integrate the UK eLoran signal into their navigation plots. For properly equipped vessels, even one eLoran transmitter can provide valuable, difficult to disrupt navigation information.
