MTI insight: From GPS spoofing to AIS manipulation – Emerging cyber tactics in maritime domain
The modern world depends on accurate signals that tell ships where they are, what time it is, and who is nearby. These signals make navigation, safety, trade and law enforcement at sea possible. But as ships have grown more reliant on electronic systems, new kinds of attacks have also emerged. These attacks do not always look like the dramatic “hacking” people imagine; often they are quiet and clever, aimed at tricking or hiding information rather than destroying systems. Two of the most important examples are attacks against satellite navigation (what people usually call “GPS”) and attacks that falsify or manipulate vessel identity messages (known as AIS). Understanding these threats and how to respond does not require technical expertise, it simply requires recognizing the kinds of problems that can happen and the common-sense steps that reduce risk.
Satellite navigation systems tell a ship where it is by receiving weak radio signals from satellites. Because the signals are so weak by the time they reach Earth, they can be overwhelmed or copied. An attacker can block the signal so the receiver loses its position fix, this is called jamming. More worrying is spoofing, where an attacker transmits fake satellite signals that lead the ship’s navigation system to compute the wrong position or time. Spoofing can be subtle. Instead of instantly moving a ship’s reported location by miles, a spoofer can slowly nudge the reported position so crew or automated systems do not notice immediately. The result can range from harmless confusion to dangerous navigation errors or even making a ship appear in a different place on tracking systems.
AIS, the Automatic Identification System, is a separate but related signal that ships use to say “this is who I am, this is where I am, this is where I’m going.” It is broadcast on radio and is intended to improve safety and situational awareness. But anyone with a radio transmitter can send AIS messages. That means someone can create “ghost ships” that appear on maps and vessel-tracking services even though they are not there, or can make a vessel appear to be in a different place, or can turn off or tamper with a ship’s AIS to hide its movements. When AIS is wrong, port authorities, law enforcement and commercial tracking services can be misled. When GPS and AIS are attacked together, an adversary can build a convincing false picture: the ship’s instruments say one location, the AIS message confirms that location, and shore-side systems have no easy way to detect the lie without extra checks.
These tactics are attractive to attackers because they can be cheap, hard to attribute, and effective. For example, a criminal group may want to hide an illegal transfer of cargo at sea. They can switch off AIS or transmit false AIS messages while arranging the transfer in a place where satellite photos or radar are unlikely to notice. A state actor engaged in a military operation may deliberately interfere with navigation near a strategic area to mask movements. Even careless or poorly configured equipment on land can accidentally jam or confuse signals over wide areas. Because these actions happen in radio space, which knows no national borders, pinpointing who did it is often difficult.
Detecting when something is wrong often comes down to cross-checks. A simple but powerful idea is that different systems should agree. If the GPS says a ship is in one place but the radar on the bridge shows it in another, or the crew can see a lighthouse with a bearing that does not match the electronic position, that disagreement is a red flag. Ships carry other instruments that measure movement in different ways, inertial sensors, speed devices, and radar, and comparing those readings with satellite positions makes it much harder for a single deception to succeed. Likewise, comparing AIS information with what radar and visual observation show can reveal AIS falsification. Shore authorities and data providers can add value by comparing many sources of information: radar, satellite imagery, commercial AIS feeds, port logs and eyewitness reports.
While detection is vital, prevention and resilience are equally important. On board, crews can be trained to carry out manual navigation procedures and to trust cross-checks rather than relying blindly on an electronic readout. Procedures that require periodic visual or radar checks, and that instruct watchkeepers to log and report anomalies, make it more likely that an attack or fault will be spotted early. Technically, ships and ports can use navigation equipment that receives signals from more than one satellite system (not just the American GPS but also European, Russian and Chinese systems), and from multiple radio frequencies; this diversity makes simple attacks less likely to work. There are also antennas and receivers designed to detect spoofing attempts, and other systems, such as regional terrestrial navigation beacons, that can serve as backups if satellite signals fail.
Organisations that manage fleets or ports need to think beyond individual ships. Cyber and radio threats should be included in safety management plans, and there should be clear lines of reporting when anomalies occur. National and regional cooperation is crucial, because an interference source on land can affect ships dozens or hundreds of miles away. Reporting incidents to authorities and to regional monitoring centers helps build a picture of where and when attacks or faults are happening, and that picture can be used to warn other vessels and to pursue technical or diplomatic responses.
Finally, it helps to remember that many of these risks are manageable with the same disciplined approach that keeps ships safe in storms or heavy traffic: do the checks, train the crew, maintain diverse tools, and report problems. Eliminating the risk entirely is unrealistic, but shifting from vulnerability to resilience is realistic and practical. By combining simple watchkeeping habits, modest technical upgrades, and stronger coordination between ships and shoreside authorities, the maritime community can greatly reduce the harm that comes from GPS spoofing, AIS manipulation, and similar emerging tactics. The goal is not to create perfect systems immune to every novel trick, but to make deception expensive, detectable and ultimately ineffective.
