Safeguard
Application Security•

GPS and Satellite Navigation Disruption: What Agencies Document

Jamming and spoofing of GPS are documented by EASA, IATA, DHS and GAO. A calm look at what they say and how to find your own timing dependencies.

Safeguard Security Team
Updated 4 min read

Many systems use satellite signals for more than maps. They use them for time. This post summarises what aviation and US government sources say about GPS interference, and how a small company can find out whether it depends on a signal it does not control.

It does not forecast a global GPS failure. No cited source does.

What happened and what is documented

On 19 June 2025 GPS World reported that EASA and IATA had released a joint plan to counter interference with satellite navigation (GNSS). It came out of a workshop on 22 and 23 May 2025 at EASA headquarters in Cologne, with more than 120 experts from industry, research, government and international bodies. IATA data cited in the article says GPS signal loss events rose 220 percent between 2021 and 2024.

The plan has four areas: enhanced reporting and monitoring, prevention and mitigation, infrastructure and airspace management, and coordination and preparedness. Recommendations include standard radio calls for reporting interference, standardised NOTAM coding, tighter controls on jamming devices, and keeping "a minimum operational network of traditional navigation aids as a GNSS backup."

EASA's Jesper Rasmussen is quoted as saying: "We are no longer just containing GNSS interference, we must build resilience."

Jamming versus spoofing

Jamming drowns the satellite signal with noise, so receivers lose their fix. Spoofing broadcasts counterfeit signals so a receiver reports a wrong position or time. The first is easy to notice. The second can go unnoticed, which is why monitoring matters.

The government view on critical infrastructure

In November 2013 the US Government Accountability Office published GAO-14-15 on GPS disruptions. It found that the 2012 DHS risk estimate "lacks key characteristics of risk assessments outlined in DHS's risk management guidance." It also found that DHS "has not measured the effectiveness of sector mitigation efforts to GPS disruptions." That is a statement about planning gaps in 2013, not about a current failure.

In December 2020 DHS released its Resilient PNT Conformance Framework, described as a guide for equipment vendors and critical infrastructure operators, with four levels of resilience. The coverage we fetched does not name the levels, so we do not describe them.

What to do now

  1. Search your systems for anything that reads GPS time or position: NTP servers fed by GPS clocks, fleet tracking, mobile device management, time sensitive logs, payment and trading timestamps.
  2. Check whether your NTP configuration uses more than one independent source. Example for chrony:
chronyc sources -v
  1. Make sure at least some sources are not GPS based, such as your cloud provider's time service or a national time server.
  2. Alert on large clock jumps or sudden loss of satellites on time servers.
  3. Add GPS dependent systems to your dependency inventory with an owner and a fallback.

Why it matters

Time is a security control. Log correlation, certificate validity, Kerberos and token expiry all assume agreed time. A drifting or spoofed clock produces failures that look unrelated. Knowing where your time comes from is cheap, and the aviation sector's own call is the same: move from containing interference to building resilience.

Quick check

What is the difference between jamming and spoofing?

Jamming blocks the signal so receivers lose their fix. Spoofing sends false signals so receivers report a wrong position or time.

Did the EASA and IATA plan predict a GPS failure?

No. It sets out measures for reporting, prevention, backup navigation aids and coordination.

Sources

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.