Spoofing ships, jamming drones: how GPS manipulation confuses and compromises.

Summary

---

T-Minus: Space-Cyber Briefing

Episode Summary: Spoofing Ships, Jamming Drones – How GPS Manipulation Confuses and Compromises

Podcast: T-Minus: Space-Cyber Briefing
Host: Maria Varmazes
Guest/Producer: Ethan Cook
Date: June 7, 2026
Main Theme:
This episode explores the practical realities of attacks on GPS signals—specifically, jamming and spoofing—and how these manipulations threaten global security, critical infrastructure, and modern warfare. Maria and Ethan break down both attack vectors with compelling real-world examples and discuss why GPS vulnerabilities are of growing concern for cybersecurity professionals.

---

Episode Overview

• This is a follow-up to last week's discussion on why GPS attacks matter; this week focuses on how those attacks actually work.
• The episode takes an accessible, sometimes humorous look at technical matters and features both geopolitical and practical implications of GPS manipulation.
• Key segments:
  1. Importance and underappreciation of GPS ([02:59] – [04:09])
  2. How GPS jamming works, with real-world examples ([05:03] – [11:12])
  3. GPS spoofing: techniques, impact, and notable incidents ([12:48] – [20:31])
  4. Broader implications, resilience, and future directions for GPS security ([20:31] – [24:12])

---

1. Why GPS Vulnerabilities Matter

The Ubiquity and Fragility of GPS

• GPS is a “cornerstone technology” for modern infrastructure, far beyond its original purpose ([02:59]):

  "It is vastly underappreciated for what a cornerstone technology it is right now. ...I don't think I appreciated how much we use it in our modern lives outside of the obvious"
  —Maria Varmazes [02:59]

• GPS manipulation is not about “hacking the satellites” ([03:46]):

  "When the phrase GPS hacking gets thrown around...I thought we literally meant hacking the GPS satellites, which I think the US Space Force is like, I'd like to see you try. ...It's a lot more ground-focused." —Maria Varmazes [03:47], Ethan Cook [04:17]

---

2. GPS Jamming: How It’s Done and Why It Matters

What is GPS Jamming?

• Jamming means overpowering legitimate GPS signals, which arrive weak to ground receivers ([05:11]):

  “They're very weak signals by the time they get here. So they are really easy to mess with or fake or overwhelm.” —Maria Varmazes [05:11]

Real-world Example: Warfare and Civilian Risks

• Used extensively in Ukraine to disrupt drone targeting ([06:31]):

  "Military drones use GPS signals to make sure they’re going to hit the intended target accurately and on time...now GPS jamming...the drone doesn't know where it's going anymore." —Ethan Cook [06:31]

• Analogy:

  "The GPS signal as it hits the Earth is like a bird gently chirping. And then if you're jamming, you've got a foghorn and you're trying to hear that chirping bird, but all you can hear is the freaking foghorn." —Maria Varmazes [07:26]

Simplicity and Dangers of Jamming

• Some GPS jammers are unsophisticated and widely available ([07:45]):

  "A lot of GPS jammers used to be, and I'm sure they still are, if you know where to look, very unsophisticated, like Bluetooth devices you could just plug into your car's cigarette lighter." —Maria Varmazes [07:45]

• Notable story: In 2013, a driver in New Jersey used a car GPS jammer outside Newark Airport, leading to significant legal trouble ([08:48]).

Illegal and Global Prevalence

• Heavy legal penalties for civilian use ([08:48]):

  "Highly illegal. Do not come after us. We have warned you."
  —Maria Varmazes [08:50], Ethan Cook [08:55]

• Live tracking of jamming:

  • Website gpsjam.org maps global GPS interference ([08:57]):

    “Ukraine lit up. Iran lit up. The Strait of Hormuz, forget it. ...Even on the US border with Mexico, there are some red spots there.”
    —Maria Varmazes [09:55]

  • Visualization shows consistency with known conflict zones (Estonia, Baltics, Myanmar).

---

3. GPS Spoofing: The More Sophisticated Cousin

What is GPS Spoofing?

• “Spoofing” alters the perceived signal, making a receiver think it is elsewhere or giving false data ([12:48]):

  "If you know what mac address or IP, address spoofing is, same concept, right? ...Manipulating [the signal] intentionally to show a different thing." —Ethan Cook [12:48]

Impact Examples

• Straight of Hormuz: Ships shown traveling in impossible patterns (over land, in perfect circles), risking collisions and environmental disaster ([13:42]):

  "...reports that a bunch of boats are being shown on land in perfect circles, which anyone who knows how a boat works, they don't travel over land." —Ethan Cook [13:42]

• Spoofing can be used by smugglers/pirates for evasion, and in drone warfare to redirect or force drones to land ([15:15]):

  "I remember...when smugglers...were all over in the news, one of the ways...they were evading notice was by spoofing their own signal." —Maria Varmazes [15:15]
  “If you tell a drone, actually, you're in airport airspace, they will go, well, time for me to go down to the ground immediately.” —Maria Varmazes [16:08]

The Rarity, Secrecy, and Difficulty of Spoofing

• Spoofing is harder, more sophisticated than jamming ([16:34]):

  "Jamming was a much more readily available topic to find information on...The pretty much what I got [on spoofing] is, this is highly illegal. We will not tell you even how it remotely functions." —Ethan Cook [16:34]

Mitening/Meaconing: Special Flavors of Spoofing

• Meaconing captures and rebroadcasts legitimate signals with slight modifications ([17:49]):

  "It just captures the legitimate GNSS signal and then just rebroadcasts it with a slight delay or modification at a higher signal strength. So it’s spoofing, but a flavor of spoofing." —Maria Varmazes [17:53]

Why is Spoofing Possible?

• GPS is old and unencrypted ([19:16]):

  "The really interesting thing to me is because specifically GPS is such an old technology, the signals are not encrypted." —Maria Varmazes [19:16]

• Some (newer) global GNSS systems may have improved security ([19:19]).

---

4. Implications for Cybersecurity and Critical Infrastructure

Critical Recommendations for Professionals

• Main defense: Risk awareness and management ([20:31]):

  “...knowing...where the heck [GPS] is being used. What are your dependencies in your environment? For GPS, I feel like it begins and ends really right there.”
  —Maria Varmazes [20:31]

• GPS insecurity is not easily “solved” at the organizational level; true solutions are at the governmental or infrastructure level ([21:18]):

  "You have redundancies in place to account for if something goes wrong, but you aren't sitting here being like, oh, let me buy the latest solution that fixes this." —Ethan Cook [21:18]

Systemic Challenges

• Incremental improvements exist, but major U.S. government modernization efforts have struggled ([19:26]):

  "...some of the work that was being done to try and make GPS more resilient...was recently canceled because it was over budget and behind schedule." —Maria Varmazes [19:26]

• Most advice for organizations: Know your risk exposure and plan for GPS unreliability ([23:27]):

  "They weren’t meant for civilian use to begin with, so they weren’t built with...the idea of...billions of us trying to poke holes in them all the time." —Maria Varmazes [23:27]

Call to Action

• Need for proactive, government-driven improvement, not passive hope ([21:46]):

  "We need to address, we need to talk about...correct that and make sure we have reasonable timelines and cost expectations and address this now." —Ethan Cook [21:46]

---

Notable Quotes & Memorable Moments

• On GPS's Fragility:
  “It’s that XKCD comic of the entire Internet being held up by that one guy in Finland...that one guy in Finland also can sometimes be GPS.”
  —Maria Varmazes [03:31]

• On the Simplicity of Jamming:
  “It’s not a sophisticated attack. No, it’s not...Highly illegal.”
  —Maria Varmazes [08:48], Ethan Cook [08:50]

• On GPS Signal Weakness:
  "The GPS signal as it hits the Earth is like a bird gently chirping...if you're jamming, you've got a foghorn."
  —Maria Varmazes [07:26]

• On the Need for Real Resilience:
  "We cannot just hope they don't get attacked. It's already being attacked."
  —Ethan Cook [21:46]

---

Timestamps for Key Segments

• Importance and dependency of GPS: [02:59]–[04:09]
• Jamming explained, real-world cases (Ukraine): [05:03]–[11:12]
• Global mapping & prevalence of interference: [08:57]–[10:32]
• GPS spoofing explained and Strait of Hormuz example: [12:48]–[15:43]
• Advanced spoofing (Meaconing) and technical detail: [17:49]–[18:32]
• Future of GPS security and advice: [19:16]–[23:27]

---

Conclusion

The episode demystifies how GPS jamming and spoofing attacks work, emphasizing their increasing relevance, simplicity of execution (for jamming), and the catastrophic consequences for critical infrastructure and modern warfare. The hosts stress the importance of organizational awareness of dependencies and systemic advocacy for stronger, encrypted, and resilient navigation infrastructures.

Main takeaway:
Know your dependencies on GPS, acknowledge its vulnerabilities, and build risk management strategies. True security solutions will require systemic upgrades and government-level commitment.

---

Transcript

[Maria Varmazes]

You're listening to the Cyberwire Network, powered by N2K. Maybe that's an urgent message from your CEO, or maybe it's a deepfake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more. Doppel outpacing what's next in social engineering. Learn [e-mail] that's.p p e l dot com. Yeah, I remember when I was researching when I first started this job a few years ago. I remember I pitched to my boss at the time, Brandon Karp, and I said, you know, Brandon, I really want to research GPS spoofing. I'm fascinated about this. And so in my naivete, I started calling a bunch of companies that sell to the US government anti GPS spoofing technology. And I was like, can you tell me how this works?

[Ethan Cook]

You're like, excuse me, who are you?

[Maria Varmazes]

Welcome, I'm Maria Varmazes and you're listening to T minus Space Cyber Briefing. In this show we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects and connects our lives. 3, 2, 1, 0, 0. Let's. Greetings, friends. Thank you for joining me today. Last week on this show, we explored why attacks against GPS and similar space systems matter in a cybersecurity context. Reminder, global navigation satellite systems like GPS are a key dependency for much of our critical infrastructure. And so this week we're all about the how. How do attacks against GPS signals typically work? Well, producer Ethan Cook joins me again to explore a few of the different attack types that we might typically encounter. Let's do this. Hey, Ethan, good to see you again.

[Ethan Cook]

I'm back.

[Maria Varmazes]

Yeah, you're back. Long time no see.

[Ethan Cook]

We're back for GPS part two.

[Maria Varmazes]

GPS part two. I mean, honestly, we're, we're probably going to have part three, four, five later.

[Ethan Cook]

It's never ending, by the way. You know, we're just going to, it's, we're just an iterative.

[Maria Varmazes]

Well, it is so crucial, and you said it brilliantly in the last episode about it is only gonna become more important to how modern technology infrastructure works. And it is vastly underappreciated for what a cornerstone technology it is right now. I certainly, I will raise my hand in that one. I don't think I appreciated how much we use it in our modern lives outside of the obvious, I think that's

[Ethan Cook]

the story of most technologies. You know, I think we're all like, man, this is so helpful. And when it goes down, we're like, this is the worst thing in the world. And then you realize, man, this is what it was 10 years go.

[Maria Varmazes]

Yeah, it's that XKCD comic of the entire Internet being held up by that one guy in Finland or whatever, which I have been told by all my friends who know this stuff that that is completely true. I think that that one guy in Finland also can sometimes be gps.

[Ethan Cook]

Yes.

[Maria Varmazes]

Do we realize how much is actually really dependent on this being accessible and the signals being correctly interpreted and all that kind of thing? When the phrase GPS hacking gets thrown around, at least when I started this job a few years ago, I thought we literally meant hacking the GPS satellites, which I think the US Space Force is like, I'd like to see you try.

[Ethan Cook]

It would be very difficult.

[Maria Varmazes]

It would be extraordinarily difficult. And they're like, bring it on, we're ready for you. So that's not. But that's not really what is meant.

[Ethan Cook]

It's a lot more ground focused and a lot more. I think the best way to describe it, at least from what I saw, was confusing signals rather than overpowering signals, rather than trying to take down networks.

[Maria Varmazes]

That's exactly it. That was. That surprised me a lot because I really thought it was like, oh, you know, the space horse is just going bing, bing, bing. And I'm sure they are genuinely staving off all these attacks against the actual satellites and the ground stations that they use. But they're in the military, they're handling their own thing for the rest of us. It is exactly that. Like just that phrase, we love the signal and the noise. This is literally that situation of like these signals being blasted out in a spherical radius from the GPS satellites. We monkey with those signals as they hit the ground because they're very weak.

[Ethan Cook]

They've gone through atmosphere, potentially weather impacts, bounced off walls. They're far, you know, gone through buildings. It's not something that you try to

[Maria Varmazes]

get GPS from inside a house. You're just like, nope, not getting it. Yeah, those are really weak signals by the time they get here. So they are really easy to mess with or fake or overwhelm. And that is essentially what. Why don't we go through maybe some of the frequent attacks against GPS signals? So we call them sort of shorthand hacking gps. But again, it's really attacks against the signals as they arrive on the ground. So what is your understanding of GPS signal jamming?

[Ethan Cook]

So it feels kind of obvious when you say it out loud and that you're jamming the signal. Right. You're killing the legitimate signal by oftentimes overpowering it. So the legitimate signal cannot go through. Yeah. Use cases for that would be okay. I don't want the signal to accurately find where I am taking that to a real world example, because I think when you talk about attacks, it's really hard to conceptualize impacts unless you have real world examples. The Ukraine war. There has been multiple use cases confirmed at this point that military drones use GPS signals to make sure that they're going to hit the intended target accurately and on time. So if there is a tank or fortification or building that I'm trying to hit as an attacker, I'm using a GPS signal to guide that drone to the correct target.

[Maria Varmazes]

Yeah.

[Ethan Cook]

Now, GPS jamming can be used to counter that. It's an emerging front. It's something that I think really has popped up as a mainstream as drones have become more popular in the Ukraine front. And I'm sure it is taking place in Iran as well, where you confuse and you overpower the GPS signals that are guiding that drone. And the drone doesn't know where it's going anymore. Yeah, it's still going to hit somewhere and explode, but it's likely not going to hit the thing that it was meant to hit. And obviously that doesn't negate its damage or reduce any casualties. You know, the logic behind it from a defensive perspective is it's not hitting the main target. So maybe it's hitting the building and still causing structural damage, but it's not going to cause the whole building to collapse or it's not going to hit the tank head on, it's going to bounce off. And maybe the tank suffers some mechanical damage, but the whole tank isn't imploded. So that's kind of the logic there.

[Maria Varmazes]

That's exactly right. On the way that I think of it for jamming is the GPS signal as it hits the Earth is like a bird gently chirping. And then if you're jamming, you've got a foghorn and you're trying to hear that chirping bird, but all you can hear is the freaking foghorn.

[Ethan Cook]

Yeah.

[Maria Varmazes]

And it's just like literally looking for that signal through the noise. Something that I found fascinating years ago when I was learning about this initially, was that a lot of GPS jammers used to be, and I'm sure they still are, if you know where to look very unsophisticated, like Bluetooth devices you could just plug into your car's cigarette lighter, if you still have one. There was a guy who did just that and got massively fined and I'm pretty sure also arrested, which makes sense. Yeah. This was back in 2013 and he operated a GPS jammer from his car sitting outside of Newark Airport in New Jersey specifically to mess with the signals that the airplanes are dependent on, which is a humongously dangerous thing. I mean, he was not the only one. This was just the headline that stuck out in my head. But you know, it is not a sophisticated attack. No, it's not.

[Ethan Cook]

Highly illegal.

[Maria Varmazes]

Highly illegal. Do not come after us. We have warned you. Don't do this.

[Ethan Cook]

It's incredibly dumb if you do.

[Maria Varmazes]

Yeah. And the equipment is extremely low cost, so it makes sense. Why, especially in war zones, this is like one of the first things that people do is your GPS is not going to do anything good for you. And as sort of dark as this is to say, one of my favorite websites to sort of track how this actually looks like on a global scale is this website called gpsjam.org and it's this really fascinating resource. I sometimes I just go there just to. This sounds weird. Just to look around. Yeah, it's just basically uses open source information based on information from commercial planes about how accurate the information is that they're getting. And you can see really easily where the contested zones are. I'm looking at it right now as we're talking. Yeah. Ukraine lit up. Iran lit up. The Strait of Hormuz, Forget it. But also looking near, I'm looking near Estonia right now. Estonia and the Baltics in general are just bright red. So is a whole bunch of the Baltics.

[Ethan Cook]

They are very close to two conflict zones.

[Maria Varmazes]

Exactly. And there are other spots, like I think I'm looking at Myanmar as well. Even on the US border with Mexico, there are some red spots there. So whether or not that is intentionally being jammed or it is jammed from other factors, this website can't delineate between

[Ethan Cook]

intentional or like atmospheric incidents or something.

[Maria Varmazes]

Or just like just heavy traffic or something. Yeah. The creator of this website, they mentioned that this is GPS interference as he can map it based on open source information. So don't try to extrapolate necessarily intent. Although in some cases it's obvious.

[Ethan Cook]

Yes.

[Maria Varmazes]

Like a conflict.

[Ethan Cook]

So surprise that you know Ukraine, not a surprise there. That GPS may be unreliable.

[Maria Varmazes]

Correct. Yeah. And also near the border with Turkey on the Black Sea. Also very, very Contested. So it also has a historical record, which again, can be fascinating looking back in time to see how bad were certain spots with GPS interference. So jamming is unsophisticated and sort of table stakes, I think, for a lot of modern warfare at this point. But sometimes it's also used in petty crime. It is accessible to dumb basic criminals who are just trying to mess with people.

[Ethan Cook]

I'm sure we'll scale up the punishment when they inevitably get caught.

[Maria Varmazes]

Yeah. So definitely don't do it in your airplanes. Good heavens. So now that we've spent some time on GPS jamming, let's take a quick break. When we come back, we're going to talk about GPS jamming's much more interesting and shall we say, sophisticated cousin. And that would be GPS spoofing. Stay with us. No one goes to Hank's for spreadsheets. They go for a darn good pizza. Lately, though, the shop's been quiet. So Hank decides to bring back the $1 slice. He asks copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hanks has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn [e-mail] Work. So good, so good, so good. New markdowns up to 70% off are at Nordstrom rack stores now. Stock up and save big on shoes, tops, dresses, accessories and more must haves for summer. Join the nordiclub to unlock exclusive discounts. Shop new arrivals first and more. Plus buy online and pick up at your favorite rack store for free. Great brands, great prices. That's why you rack. Ethan, I want to you, you take the glory on this one. Explain GPS spoofing.

[Ethan Cook]

So if you know, for your cyber professionals out there, if you know what map our Mac address or ip, you know, address spoofing is same concept, right? We are taking our signal. We would be displayed as and manipulating it intentionally to show a different thing. A great real world example where this is happening already is in the strait of Hormuz. A lot of boats going through there. Well, maybe not as much as it used to be, but a lot of boats should used to be going through there. But you know, we use GPS signals. Boats use them to make sure that we and airplanes too, to make sure we aren't colliding with each other. Because these are massive vehicles, especially boats that are hauling very Very expensive precious cargo. If we were have a collision, not only would that be an environmental disaster, but it would be a significant financial loss. We saw what happened in the Suez Canal a couple years ago when that one boat got stuck in the side.

[Maria Varmazes]

Yes, the ever something.

[Ethan Cook]

Yeah, I can't remember the company.

[Maria Varmazes]

It was a weird name.

[Ethan Cook]

Shutting down a key choke point like that is pretty big. Now that was a legitimate example of just someone deciding to by accidentally steer into a canal wall. But I think in the Strait of Hormuz example, you have reports that a bunch of boats are being shown on land in perfect circles, which anyone who knows how a boat works, they don't travel over land. Crazy stuff.

[Maria Varmazes]

I was not familiar with that. Thank you for clarifying.

[Ethan Cook]

Yeah, it's revolutionary. This is why I went to college. And so anyone who looks at the map goes, ha, ha, ha ha. That's obviously not correct. Right. But I think when you boil that down to actual real world impacts, the answer is, okay, let's say it's nighttime on a foggy day on the sea by the Strait of Hormuz and you really can't see a boat and you're having to go through to deliver the oil or go pick up oil and you go, oh, oh, we have now slammed into another boat. Or you have now slammed into a. Because maybe your address is being also jammed simultaneously so you don't know where you are either. You have now slammed into a seabed that you can't get out of. Right. And you take that to a logical conclusion. It is dramatically impactful. It could shut down trade lanes, it could shut down effective communications. Human life factor is absolutely something that needs to be talked about. These are real world impacts that have significant costs to them.

[Maria Varmazes]

Yeah. The consequences are especially catastrophic for spoofing. The Strait of Hormones is a fantastic example. I remember not that long ago when smugglers were all over the like pirates were all over in the news. One of the ways that I think they were all also evading notice was by spoofing their own signal and being like, yep, we're definitely not where you think we are.

[Ethan Cook]

We're not in the middle of X, Y and Z. We are, you know, 800 miles to the, to the west and you're never going to be able to see or find us.

[Maria Varmazes]

Yeah. In fact, we're on the ground, don't even worry about it. Yes. You mentioned drones a little earlier. That's another huge problem because drones also are, you know, key in modern warfare. Yeah. And if you completely redirect where the drone's gonna go. Not just confuse it, but just, like, send it elsewhere or tell it to actually, hey, you're in the airspace of an airport, which will force it to land.

[Ethan Cook]

I didn't know that.

[Maria Varmazes]

Yeah, yeah. If you tell a drone, actually, you're in airport airspace, they will go, well, time for me to go down to the ground immediately. So, I mean, drone operators know that, but, like, that is a frequent way of kind of trying to mess with them and disrupt their operations. So spoofing is much more sophisticated. It is not easy to broadcast out a different signal that has bad information in it. So this is usually something we see the military doing.

[Ethan Cook]

I was gonna say, when I was doing my research, jamming was a much more readily available topic to find information on and cover spoofing. The. Pretty much what I got, which is, this is highly illegal. We will not tell you even how it remotely functions. And if you do it, it is a significant punishment.

[Maria Varmazes]

Yeah. I remember when I was researching, when I first started this job a few years ago, I remember I pitched to my boss at the time, Brandon Karp, and I said, you know, Brandon, I really want to research GPS spoofing. I'm fascinated about this. And so, in my naivete, I started calling a bunch of companies that sell to the US Government anti GPS spoofing technology. And I was like, can you tell me how this works?

[Ethan Cook]

Excuse me, who are you?

[Maria Varmazes]

I swear, this is for legitimate purposes. So obviously, nobody told me anything, that no one was gonna do that, of course. And I stupidly even tried. As I said, I'm on a list somewhere, if I wasn't already. But it was a dumb question to even ask, but I was genuinely curious. So the answer is, maria, if you want to find out, go join the military. So that's.

[Ethan Cook]

And work your way to the top.

[Maria Varmazes]

Work my way to the top? Like, yeah. And there's a flavor of spoofing that I keep finding a reference to. Have you heard of this one called Meekening?

[Ethan Cook]

I have not, but I love the name. Yeah, it's a great name.

[Maria Varmazes]

Yeah. I saw mention of it, and I'm going, that's fascinating. So instead of trying to broadcast a different fake signal that says, actually, I'm over there, it just captures the legitimate GNSS signal and then just rebroadcasts it with a slight delay or modification at a higher signal strength. So it's spoofing, but, like, a flavor of spoofing. And the receiver, whoever they are, that signal looks extremely legit to them. It doesn't look like it's been messed

[Ethan Cook]

with, but it's slightly off. Just enough.

[Maria Varmazes]

Just off enough that it could probably evade a quick glance, essentially. So because the signals are legit, but just like mistimed. Yeah.

[Ethan Cook]

Well, going to the point on the timing ambulation that we talked about last episode.

[Maria Varmazes]

Yes. And how insidious this could be. But there are lots of. If you're in the military or the government, there are lots of vendors that will sell you solutions for this. And that is not our lane. But these problems are only getting more and more insidious and the consequences are more and more catastrophic as we become increasingly dependent on gps. The really interesting thing to me is because specifically GPS is such an old technology, the signals are not encrypted. No. So I know forward thinking, the idea is one day these signals will be more spoof resilient because they will be encrypted. And some of the GNSS systems in other parts of the world have better

[Ethan Cook]

signal, I would imagine because they're newer as well.

[Maria Varmazes]

Yeah, yeah.

[Ethan Cook]

You have security forward mindsets when you invented them or built your networks 20 years later.

[Maria Varmazes]

Yes, that's exactly it. And we got into it a little bit with my interview with Dr. Sean Gorman. But some of the work that was being done to try and make GPS more resilient, especially in the ground systems, unfortunately was recently canceled because it was over budget and behind schedule.

[Ethan Cook]

Yeah, yeah. Ten years behind schedule and double the cost. The military likes to give you a long leash for off time and overpriced projects. But that was a. Yeah.

[Maria Varmazes]

Even though that one. Yeah, they've got their limits. So the line from the Space Force is they've got these incremental improvements that they're working on to make sure that at least for their things, things are, you know, more secure and they can ensure the fidelity of the signal that they're receiving and interpreting. But yeah, GPS is speaking specifically about gps. It's an older system and satellites are being incrementally replaced over time. But you know, it's not a wholesale thing. It's just kind of one in, one out. Maybe one day we'll have fully encrypted signals from GPS would be nice, but it's not tomorrow,

[Ethan Cook]

it's not in the next five years.

[Maria Varmazes]

No, no. So I think the advice for a cybersecurity professional knowing that like pretty much everything in modern society there are a lot of flaws and this technology that can be easily exploited is just knowing, in my opinion, where the heck it's being used. What are your dependencies in your environment? For gps, I feel like it begins and ends really right there.

[Ethan Cook]

I think it's a, it is a risk management factor. It is something that you should be aware of if you're, if you're in, let's say finances, where you're prone to it, or it could be impactful, but it is not something that you as an individual or even as an organization can make and, you know, really shake up and fix. This is kind of the thing that you, you have redundancies in place to account for if something goes wrong, but you aren't sitting here being like, oh, let me buy the latest solution that fixes this.

[Maria Varmazes]

That's not, you know, the average infosec professional is not going to be no securing gps. That, that's the Space Force's job.

[Ethan Cook]

That's the thing you cross and hope for that. We got good people there.

[Maria Varmazes]

Yeah, exactly. Best men and women working on that. So, yeah, so just knowing that your dependency and managing that risk as best you can, planning around the fact that is not infallible, that's really the takeaway of an advice there as far as I'm concerned. But Ethan, I'm curious if there's any other thoughts you have on that.

[Ethan Cook]

Yeah, I think it kind of reinforces the conversation that these are technologies that. Because especially with the modern world as we continue to advance, these are not something that we can just hope they don't get attacked. It's already being attacked. These are things that already people are trying to exploit and successfully do all the time. And we should not rest on the laurels of let's hope it gets better or hope that we can just deal with this. This is something that I think a proactive approach of. We need to address, we need to talk about. We need to get governments invested in wanting to increase these, even if previous attempts haven't necessarily been successful. Don't let that kind of be the dying point. Let that be the initial point of a conversation of like, okay, we need to learn why this didn't work previously in our last attempt. Correct that and make sure we have reasonable timelines and cost expectations and address this now.

[Maria Varmazes]

Yeah, that's a federal government procurement right there. That's a whole other show. But I know that's a lot of your world also, so that's good points though.

[Ethan Cook]

It's a headache world.

[Maria Varmazes]

Yeah, no, that. The understatement of the century right there. As we're talking through and as I was listening to you talking about gps, a lot of this reminds me of just discussions about how the Internet came to be. And they said, well, maybe we'll let civilians start using this and not just like a few universities. I mean, they never could have anticipated what it would become. And same thing I don't think they

[Ethan Cook]

did with GPS when Clinton was like, hey, guys, everyone's. It's free for everyone. You know, go crazy. I don't think the logical conclusion was, well, what are the modern implications of drone warfare for this?

[Maria Varmazes]

What's a drone?

[Ethan Cook]

Yeah, exactly.

[Maria Varmazes]

None of this was anticipated, and it's been successful beyond the United States military's wildest dream, I'm sure. And it's what. What an incredible legacy. Not again. They're not paying me to say that. It's just. It's. It's just kind of amazing, the Internet and gps, like, what. What they've ended up becoming. They weren't meant for civilian use to begin with, so they weren't built with, you know, the idea of thousands of millions of literally billions of us trying to poke holes in them all the time. Exactly. So. And yet that's what we're doing because we're human beings, so we have to kind of just do the best we can with these flawed because they're made by humans systems. So, yeah, know your dependencies and you risk exposure. And that's about it. Yeah, I think.

[Ethan Cook]

Well said.

[Maria Varmazes]

Yeah. Thank you. All right, well, Ethan, thanks again for joining me and thanks for having me. Yeah, of course. Come on back next time.

[Ethan Cook]

Always.

[Maria Varmazes]

And that's t Space Cyber briefing, brought to you by N2K CyberWire. If you like what you heard today, you will also enjoy our newsletter signals and Space. You'll get research and notes pulled together by our producer, Ethan Cook and me, along with this week's top Space Cyber news stories. Subscribe by visiting TheCyberWire.com newsletters that's newsletters with an S. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like this show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space2k.com we're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K helps helps cybersecurity professionals grow, learn and stay informed. As the nexus for discovery and connection, we bring you the people, technology and ideas shaping the future of secure innovation. Learn [e-mail] thank you for listening to T minus. I am your host Maria Varmazes. The show is produced by Ethan Cook and Liz Stokes. We are mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our Executive producer is Jennifer Ibin with content strategy by Mayan Plout. Peter Kilpe is our publisher and we will see you next week. T minus. Foreign.

[Ethan Cook]

The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. @blinds.com We've spent 30 years making it surprisingly simple to get exactly what your home needs. We've covered over 25 million windows and have 50,000 five star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure right now. Get up to 45% off site wide plus get a free professional measure. At blinds.com rules and restrictions apply.