Civilian GPS can be faked because its signals are faint and predictable
The satellites transmit with about the power of a dim bulb, so a small ground transmitter can drown them out with a false location.
Computerphile · GPS Hidden Messages - ComputerphileYour phone finds you by listening to space. Each navigation satellite broadcasts how far away it is, along with where it is at that moment, and if your phone can measure its distance to four satellites at once, it can solve for its position on Earth. That extra information rides on top of the positioning signal very slowly, at only 500 bits per second, a researcher says.
The problem is how fragile that listening act is. The civilian GPS signal is public, published, and completely predictable, so you can calculate what the signal should look like not only where you are, but for any other place in the world. It is also extraordinarily faint. The researcher describes the transmitted signal as "about the same power as a dim light bulb," and by the time it has crossed space to Earth it is almost negligible.
That combination is what makes spoofing possible. Because the real signal is so weak, even a very small transmitter on the ground can drown it out. An attacker who broadcasts a carefully calculated copy, the signal your receiver would hear if you were somewhere else, can start to confuse GPS receivers into believing the false location.
That is why the military does not rely on the public signal alone, even though it uses the same satellites. Its version carries encrypted data, and a receiver needs both the satellite measurements and the secret encryption key to use it. The keys go only to the United States and its allies, and without knowing the key, an attacker finds the signal much harder to predict. That added uncertainty leaves attackers struggling to fool receivers or to interfere with precision.
Questions people ask
Why does GPS need four satellites?
You need three distances to narrow your position to two possible points in space, and a fourth to pick the right one and correct for error in your phone's clock. In practice your receiver listens to many more satellites when they are visible, to improve accuracy.
Is spoofing the same as jamming?
Yes. Jamming simply blasts noise to prevent a receiver from hearing the satellites at all, while spoofing sends a convincing false signal so the receiver reports the wrong place or time. Spoofing is more subtle and often more dangerous, because the victim may not realize anything is wrong.
Can my phone tell when its GPS is being spoofed?
Usually not. An ordinary phone or car navigator trusts whatever looks like a valid civilian signal, because that signal was designed to be open and easy to receive. More specialized receivers can watch for odd jumps in signal strength, timing, or direction, but that protection is not built into most consumer devices.