Traffic on busy I-95 highway passes close by Newark Airport
GNSS Jamming in the Name of Privacy
Potential Threat to GPS Aviation
The effects of GNSS jammers, and particularly so-called personal privacy devices, on nearby augmentation systems used to aid approach and landing of aircraft can range from transient and isolated to extensive and severe. In some cases, nearby jammers can lead to multiple reference receivers being flagged as unusable to protect system and user integrity. This article describes incidents at Newark International Airport and other aviation facilities as examples of the adverse effects of such devices and discusses several mitigations that have been implemented.
RF interference (RFI) has been and will continue to be a significant worry for GNSS users.
Because the signals from GNSS satellites are very weak by the time that user equipment receives and processes them, they are especially vulnerable to RFI. Signals that overlap GNSS frequencies are likely to come from transmitters much closer than the satellites and, consequently, can easily overpower GNSS signals and render them unusable.
To protect GNSS, existing regulations prohibit the intentional broadcast of any non-GNSS signals on or near GPS L1/Galileo E1, while lesser restrictions apply to the GPS L2 and GPS L5/Galileo E5A frequencies. Both L1/E1 and L5/E5A are in protected Aeronautical Radio Navigation Service (ARNS) bands, but other aviation navigation systems such as DME and TACAN also transmit near L5/E5a. Despite these protections, RFI affecting GNSS at L1/E1 is occasionally observed, and its apparent frequency has increased significantly with the number of civil GNSS users.
Many, perhaps most, incidents to date have involved unintended or accidental interference. The article by W. R. Vincent et alia, listed in the Additional Resources section near the end of this article, recounts a 2001 case of accidental interference caused by defective amplifiers attached to UHF/VHF television antennas.
A more recent incident is described in the article by W. Dunkel et alia. In that case, transmissions from a "GNSS repeater" used to check the functionality of GPS equipment on airplanes within a hangar at a German airport leaked outside the hanger because the repeater transmit power was set too high. The resulting interference to GPS signals received from the sky was reported by several other aircraft using that airport.
This article, however, will focus on the interference caused by personal privacy devices (PPDs) that are intended to prevent people and vehicles from being tracked within a limited area. These devices deliberately transmit signals at or near GNSS frequencies to make GNSS unusable within a region around the PPD where the PPD signal overpowers the GNSS signals. Although their use (but not necessarily possession) is outlawed in the United States and many countries, these products are widely available and, indeed, seem to be increasing in number.
We will first discuss the interference created by PPDs and their characteristics. Next, we will examine the effects of PPDs on the Wide Area Augmentation System (WAAS) reference station (WRS) in Leesburg, Virginia, and their impact on the Ground Based Augmentation System (GBAS) ground facility at Newark Airport in New Jersey.
This article describes the GBAS hardware and software modifications being pursued to limit the effects of PPDs at Newark Airport so that acceptable GBAS Category I precision approach service can be provided. We will conclude with discussion of additional mitigation steps that will be made possible by GNSS modernization.
Types of RF Interference
The first category is malicious interference, meaning RFI that is intentionally transmitted to prevent the use of GNSS (or make its use hazardous) for as many users as possible. Coordinated hostile broadcasts of RFI, while hopefully very rare, have the potential to make GNSS unusable over large regions and are difficult to defeat. Therefore, it makes sense to provide non-GNSS backup services to support transportation and other critical infrastructure needs.
The second category, and the focus of this article, is uninformed interference, which results from the intentional transmission of signals at or near GNSS frequencies but without the desire to cause harm. At first, it may seem that signals deliberately broadcast on or near GNSS frequencies are likely aimed at harming GNSS users, but this is not true in the vast majority of cases, as will be illustrated in the following sections. So-called personal privacy devices, or PPDs, fall into this category and are of particular concern due to their rising popularity.
The third category is accidental interference, which results from unintentional transmissions appearing at or near GNSS frequencies. This type of interference typically arises from malfunctions of equipment designed to transmit at non-GNSS frequencies or not to transmit at all. It is less common than uninformed interference because such malfunctions are rare and more rapidly detected now that many GNSS receivers are likely to be in use nearby. On the other hand, accidental interference is more variable and may be more problematical because of its unpredictable and unintentional nature.
Characteristics of PPDs
Freight and delivery trucks, in particular, are now commonly monitored by their dispatch centers using GNSS and a communications link. This has significantly changed the working environment of truck drivers over the last decade, some of whom resent the resulting loss of independence. The 21st century has experienced an increasing fear of governmental or corporate surveillance and an attendant loss of personal privacy.
As one result of this, ordinary citizens may attempt to protect themselves from such surveillance, including the use of PPDs, without understanding the consequences of the measures they take. Stolen vehicles or vehicles involved in illegal activities are other examples of potential PPD sources.
Inexpensive, mobile GNSS RFI transmitters are easily obtainable on the Internet and elsewhere, making it easy for drivers to translate their worries about privacy into action. As noted earlier, GNSS signals are very weak when received by users and can easily be overwhelmed by a nearby device transmitting at neighboring frequencies. For vehicles equipped with GNSS receivers, a small, low-power device can easily transmit enough power to jam the GNSS receiver and make it unusable.
Unfortunately, as in the case of the GNSS repeater example mentioned earlier, the zone of effectiveness of such jammers can easily extend far beyond a vehicle and affect other users that depend on GNSS for safety-critical applications. PPDs violate the frequency protections established for GNSS, and their use is illegal in most countries. But enforcement is difficult, and penalties in the United States are limited in most cases to requesting that users surrender their devices.
Recently, several organizations have acquired and tested PPDs under controlled laboratory conditions to better understand their behavior and their potential impact on GNSS receivers. The results of these studies have been published in several recent papers (e.g., the article by T. Kraus et alia listed in the Additional Resources section near the end of this article).
Figure 1 shows the PPDs tested by Dr. Kraus’ study at the University of Federal Armed Forces (FAF), Munich, Germany. These are very small devices, and some are clearly designed to fit into "cigarette lighter" power sources in automobiles. Note that the second one from the right does not use an external antenna so as to better camouflage itself as a mobile phone.
Figures 2 and 3 show signal outputs from the PPDs shown in Figure 1. Figure 2 shows the very-narrow-band spectrum generated by two of the cigarette-lighter- type PPDs. These devices transmit a signal at a single frequency very close to L1 that changes slowly with the temperature of the device.
The bandwidth of this signal is so narrow (less than one kilohertz) that it can be modeled as "tone" or "continuous wave–like" interference, which is significantly attenuated by the spread-spectrum nature of GNSS codes. However, the GPS L1 C/A-code has a short period of one millisecond and contains spectral lines or "teeth" of 100-hertz width spaced one kilohertz apart.
Because the center frequencies of these lines move as the satellite Doppler frequency offset changes, the CW-like signal shown in Figure 2 is likely to overlap with the spectral lines of one or more satellites at a time and greatly limit the usefulness of the C/A code (as discussed in the textbook by P. Misra and P. Enge).
Figure 3 shows the pattern of broadband interference that is generated by most PPDs. In this case, the bandwidth of the jamming signal is about 12 MHz, with the center frequency being very close to L1.
As shown in the work by T. Kraus et alia, this spectrum is created by rapidly varying the frequency of a CW-like signal. For example, the PPD shown in Figure 3 changes its frequency linearly from about L1 –6 MHz to L1 +6 MHz in a period of about 12 microseconds (~ 1 MHz/μs), after which the pattern repeats. This generates the effect of broadband interference with simple RF design and components.
Table 1 again refers to the article by T. Kraus et alia and summarizes the characteristics of seven PPDs tested and reported therein. The CW-type interferer shown in Figure 2 is designated as Class I in this table, while different varieties of Broadband interferers are divided into Classes II, III, and IV (Interferer No. 2 of Class II is the one shown in Figure 3).
What is most notable within this set of seven devices is that the peak power varies by almost 20 decibels. The two CW-like Class I devices (numbers 1 and 4) are very similar except that their peak power differs by 13.5 decibels. While all of these PPDs are likely to make GNSS L1 signals unusable within the 5–10-meter radius needed to "protect" a vehicle, some of them have enough additional power to jam L1 tens to several hundreds of meters away.
The fact that PPDs make GNSS unusable well beyond the zone that they are intended to protect is not surprising for several reasons. First, PPDs tend to be advertised based on power output, similar to mobile-phone jammers (which are likely produced by the same people). Many users may not realize that jamming areas beyond the intended vehicle is undesirable because it increases their chance of being detected.
Second, PPDs are made and sold cheaply. Consequently, quality control in manufacturing is often lacking. Even though PPD users are knowingly degrading their own GNSS signals, many (if not most) do not realize that other GNSS users are forced to suffer similar degradations as a result of the poor quality of their PPD equipment.
Impact of PPD RFI on WAAS Reference Station
Each WRS has three reference receivers with antennas spaced a few meters to tens of meters apart. These plots show the results from one receiver, as the results from the other two reference receivers are very similar.
The plot in Figure 4 covers the entire day (1,440 minutes) of April 9 and shows two similar events where C/N0 drops significantly on all three GEO satellites. This disruption appears and then quickly goes away, which is suggestive of a PPD in a moving vehicle rather than RFI from a fixed location.
Figure 5 shows an eight-minute, zoomed-in window focused on the earlier event on April 9. The data indicate that the RFI event was brief but actually occurred in two stages, one between t = 507–508 minutes and another shortly after from t = 509–510 minutes.
Figure 6 shows a Google map of the roads near the Leesburg WRS. Vehicles traveling along the two main roads adjacent to the WRS (i.e., from Route 7 to Highway 15, or vice versa) would approach within 200 meters of the WRS antennas at two different points but be significantly further away in between those points. In addition, variations in ground cover between the roads and the WRS can make a significant difference.
Observations made over several months by Zeta Associates confirmed that the RFI shown in Figures 4 and 5 was due to a PPD-equipped vehicle that passed by the Leesburg WRS on a regular basis in the morning and afternoon. The regularity of the driver’s schedule allowed him to be eventually pulled over and his PPD surrendered.
The threat of RFI of PPDs to WAAS and SBAS is relatively limited because SBAS networks include many widely spread reference stations. As a result, these networks are usually robust to temporary losses of individual reference stations.
The same is less true of GBAS, where all reference receivers serving a given airport are located within the property of that airport and have antennas that are typically sited within 100– 200 meters of each other. Therefore, a single powerful interferer could potentially deny GBAS service for an entire airport. The impact of PPDs on the GBAS installation at Newark Airport (EWR) in New Jersey (near New York City) is described in the next section.
Impact of PPD RFI on GBAS at Newark Airport
The U.S. version of GBAS is known as the Local Area Augmentation System, or LAAS, and the ground-station component of LAAS is known as the LAAS Ground Facility (LGF). Several sites for the LGF at Newark were considered, but the only one that met the requirements established at the time of siting (2008-2009) was the one shown in Figure 7.
As detailed in the Google map in Figure 8, the LGF site at Newark consists of four reference receiver antennas arrayed more or less in a straight line with separations of about 100 meters. All four antennas are within 200 meters of heavy traffic (more than 100,000 vehicles passing the location each day) along the New Jersey Turnpike (I-95). The proximity of I-95 had not been expected to pose a problem prior to installation. During testing after installation in late 2009, however, the system went into "alarm" mode, requiring system shutdown and loss of service (see the article by J. Warburton and C. Tedeschi).
A subsequent investigation revealed that, as occurred at the Leesburg WRS site, multiple reference receivers suffered large drops in C/N0 on GPS L1 C/A code on multiple satellites, making them unusable. Further work by the FAA and Zeta Associates confirmed that these events were due to RFI coming from the direction of I-95 and caused by PPDs on passing vehicles.
Prior to the software and site modifications described later in this article, PPD interference was observed as often as several times per day. RFI remains present there today, but the mitigations applied thus far have reduced the frequency of PPD-related incidents strong enough to affect the LGF to several per week on average.
Figure 9 shows a graphical representation of two of the key integrity monitoring algorithms within the LGF that detect the presence of RFI when it occurs (see the paper by G. Xie). Because the algorithms required to protect the integrity of GBAS are very sensitive, they almost always detect RFI before its effect is evident in the form of a loss of satellite tracking.
Fortunately, the quality of measurements provided by the multipath-limiting antennas used at the Newark LGF is sufficient to enable these monitors to cleanly distinguish nominal conditions from those which are unacceptably degraded by RFI; e.g., the real-time signal-strength (C/N0) monitor shown in Figure 9. Nominal measurements, meaning those affected by RFI within tolerable limits, almost always provide C/N0 measurements of at least 35 dB-Hz, even for low-elevation satellites.
The highest value of C/N0 for which hazardous errors are possible (under very conservative assumptions) is around 32 dB-Hz. Thus, placing a C/N0 threshold slightly above 32 dB-Hz insures detection before any hazard can occur while making "false" detections under nominal conditions very rare. A similar situation applies to the carrier-phase residuals monitor also shown in Figure 9. (Note that the RFI signal characteristics expected to be tolerated by LGF and airborne receivers are specified in Appendix D of the RTCA Inc.’s Minimum Operational Performance Standards, or MOPS, for LAAS Airborne Equipment.)
Figure 10 depicts a simplified diagram of a typical PPD interference scenario at Newark. In this example, a truck equipped with a powerful PPD is traveling southbound on I-95 at freeway speed and is approaching the northernmost of the four LGF receiver antennas (RR 4). Once the truck gets close enough to RR 4, measurements on most satellites tracked by RR 4 will become unusable due to detection by one or more monitor algorithms or simply loss of receiver tracking.
Because the reference receiver antennas are only separated by 100 meters, a PPD powerful enough to jam one could easily jam two receivers (e.g., RRs 4 and 3) once it reaches the proper position on the road. Given sufficient additional power, all four RRs could be jammed and become unusable at the same time. The more likely event is that, as the truck moves southward and proceeds to jam RRs 3, 2, and 1 in succession, the northern RRs become free of jamming and are able to track satellites again.
The recovered measurements of affected receivers are not immediately usable to form broadcast pseudorange corrections. This delay occurs because both the receivers’ carrier-smoothing filters and the filters used in their integrity-monitor algorithms must be restarted and allowed to re-converge. However, if enough usable measurements remain present throughout the pass-by of the PPD, GBAS can still provide uninterrupted full-integrity service.
Our current expectation is that the potential threat of PPDs to GBAS (and SBAS) primarily revolves around the ground station reference receivers rather than receivers on aircraft in flight, but more work needs to be done to test this hypothesis. The geometry at Newark is such that PPDs on I-95 are much closer to the GBAS reference receivers than they could ever be to approaching aircraft. However, PPDs on other nearby roadways could be closer to approaching or taxiing aircraft than they are to the reference receivers.
In general, the worst-case scenario for PPDs affecting aircraft would be a high-traffic highway running underneath the decision-height location of a precision approach. For Category I approaches down to a 200-foot decision height, a PPD could theoretically be as close as 200 feet (61 meters) below an aircraft and therefore potentially cause interference.
Fortunately, GNSS antennas used by aircraft are typically located on the top of the fuselage where they enjoy substantial (perhaps about 10 decibels) resistance to transmissions coming from below the aircraft. In addition, unlike reference-receiver antennas, approaching aircraft are moving rapidly and would be exposed to nearby PPD interference for only a very brief period during an approach.
Because no precautions against PPDs had been taken in the original LGF design and siting at Newark, the frequent presence of PPD interference caused the LGF to interrupt service multiple times per week. Some of these interruptions generated alarms that required manual intervention to re-start the system. The overall effect was that the availability and continuity requirements for Category I precision approaches could not be met (although integrity was protected by the monitor alerts and shutdown procedures).
Note that the Newark GBAS has not been approved for service; thus, these interruptions did not affect flight operations. The key to obtaining service approval at Newark is showing that the GBAS can meet the integrity, continuity, and availability requirements for Category I precision approach despite the presence of PPDs. Once the PPD threat was better understood, a series of software and hardware modifications was undertaken to make this possible. The next section describes how this is being done and suggests future modifications.
As shown in the example in Figure 10, a powerful PPD interferer can jam more than one reference receiver at a time. In the Block 0 software, the loss of measurements from more than one receiver led to system shutdown, meaning (at a minimum) the broadcast of empty pseudorange correction measurements, making the system unusable by aircraft for some time.
The most important change in the Block 1 software allows the brief loss of two reference receivers while still providing corrections and usable service. This means that the integrity monitor algorithms, which previously assumed that measurements from at least three receivers would always be available, had to be reconsidered from the standpoint of meeting all requirements with only two receivers for a short period.
The updated algorithms only need to accommodate an outage period of a few minutes because, in most cases, the PPD will have "moved on down the road" by then. Nonetheless, this is a significant challenge because relatively little performance margin exists for some of the monitors. Versions of the Block 1 software have been in use at Newark for some time and show significant progress in reducing the impact of PPDs on system availability and continuity. The potential effects of the Block 1 changes on integrity remain under review at the time of this writing.
Several hardware improvements have also been implemented at Newark. One was to adjust the height of the antenna connected to reference receiver (RR) 2, which originally had the highest occurrence of PPD-driven measurement losses (see the presentation by C. Tedeschi listed in Additional Resources).
At first, raising the antenna was expected to reduce the amount of RFI from PPDs by taking advantage of the gain pattern of the antenna, which is designed to reject multipath coming from the ground. However, when this was tried, the RFI was found to have worsened, as the shielding effect of nearby obstructions was lost. Therefore, it made sense to try lowering the antenna height, which succeeded in reducing the RFI effect on RR 2 to about the same level as the other three reference receivers.
The example in Figure 10 demonstrates the potential disadvantage of having all four reference receiver antennas so close together and, therefore, vulnerable to PPD RFI at the same time. The FAA conducted tests in which RR 1 and its antenna were temporarily moved about 500 meters further south, away from the other three antennas, to see how much benefit would be gained.
Although the reference receiver configuration shown in Figure 8 is expected to be retained for Category I precision approach service (perhaps with additional height adjustments), several others have been considered for the future. One example would separate the northern and southern pairs of antennas by 500–1,000 meters, while each pair is separated by about 200 meters. This configuration makes it less likely that two reference receivers will be jammed at the same time by a single PPD and much less likely that more than two receivers will be affected.
Separations larger than 100 meters are also preferred because of the proposed addition of carrier-phase-based monitoring of ionospheric spatial gradient anomalies for GBAS ground stations supporting Category III precision approaches and landings (see S. Khanafseh et alia). While the GBAS system at Newark is limited in the receiver spacing that it can support, future GBAS ground-station designs may support much larger separations (more than one kilometer), which would almost ensure that a single PPD could not affect more than one reference receiver at a time.
As noted earlier, options at Newark Airport are limited by the fact that few (if any) usable reference receiver sites exist outside of the zone close to I-95. However, an obvious lesson from the Newark experience with PPDs is to stay away from busy roads to the extent possible.
The Google map in Figure 11 shows how this lesson has been applied at Houston George Bush Airport (IAH), Texas, which is surrounded by much more open space. The reference-receiver site selected at Houston is more than one kilometer away from the nearest road with any substantial amount of traffic (FM 1960). Although PPD interference has been observed at other locations on the airport grounds (e.g., John F. Kennedy Blvd.), the LGF receiver site is sufficiently isolated that very little, if any, PPD interference is expected to be strong enough to reach it and cause a noticeable effect.
Summary & Potential of GNSS Modernization
We have described the impact of PPDs on the GBAS ground system at Newark Airport in detail. Because severe siting constraints at Newark required that the reference-receiver antennas be placed near and parallel to a very busy freeway, frequent RFI from PPDs was noticed almost immediately after site installation.
In protecting the integrity of the received measurements, the ground station shut down frequently and stayed offline long enough to cause GBAS failures in meeting precision approach availability and continuity requirements. Once the characteristics and effects of PPDs were better understood, a series of hardware and software modifications were implemented to allow the ground station to continue operating safely under a greater range of RFI conditions and to recover quickly and automatically once strong RFI disappears.
Testing and evaluation of these modifications continues at the time this article was written. If all goes well, the upgraded Block 1 software as well as the hardware and siting modifications at Newark will be approved to support Category I precision approach operations later in 2012.
While many approaches to mitigating PPDs are possible within the framework of today’s GNSS, a future of multiple interoperable GNSS constellations offers significant benefits, as illustrated in Figure 12. One reason that GBAS and other systems are vulnerable to RFI coming from sources on the ground arises from the need to track low-elevation GNSS satellites in order to obtain a high probability of "good" satellite geometry (e.g., low Position Dilution of Precision, or PDOP).
GBAS, for example, must provide corrections for satellites at elevation angles down to five degrees in order to maximize the usable GPS satellite geometry at the aircraft. Reliably tracking GPS satellites at five degrees requires antenna gain patterns that are at least somewhat receptive to interference coming from the vicinity of 0 degrees.
However, in a future with multiple interoperable GNSS constellations, a much higher effective mask angle (perhaps as high as 15–20 degrees) could be applied, as low-elevation satellites would not be needed to achieve good positioning geometry. Allowing reference-receiver antennas to reject signals below 10 degrees would greatly add to the resistance of GBAS ground stations to RF interference of all types and reduce the need for siting antennas far from each other and away from roads.
The authors thank Todd Walter, Sherman Lo, and others at the Stanford GNSS laboratory for sharing their thoughts and recollections regarding past examples of RF interference. They would also like to thank Karl Shallberg and Joe Grabowski of Zeta Associates for providing WAAS Reference Station data from the ZDC site and explaining features of the results.
In addition, the authors thank Kim Class, Mike Meyer, Mike Meemken, and their colleagues at Honeywell for their data and observations of the impact of PPDs on the SLS-4000 installation at Newark airport. They would also like to thank Winfried Dunkel of DFS and Michael Felux and his colleagues at DLR for their information regarding interference generated by GNSS repeaters at German airports. This article is based on a paper presented at the 2012 Institute of Navigation International Technical Meeting in Newport Beach, California.
ManufacturersThe LAAS Ground Facilities is known as the SLS-4000 SmartPath Precision Landing System, which is supplied by Honeywell Inc., Phoenix, Arizona, USA. It includes four BAE ARL-1900 GPS antennas from BAE Systems, Greenlawn, New York, USA, and CMC reference receivers. The WAAS Reference Stations were provided by Raytheon Company of Fullerton, California, USA. Each WRS includes three G-II WAAS Reference Receivers made by NovAtel, Inc., Calgary, Alberta, Canada.
Copyright © 2015 Gibbons Media & Research LLC, all rights reserved.