GPS Spoofing

GPS spoofing explained: how it works and how it affects vessel operations

Key Takeaways

• Spoofing creates a coherent but false navigation picture. GNSS continues to provide stable, reliable data that feeds directly into ECDIS, AIS, radar overlays, and CPA/TCPA. The bridge sees a consistent but incorrect situation with no alarm.
• Detection relies on discrepancies with independent inputs. There is no system-level warning. Spoofing is identified only when GNSS data conflicts with radar, visual bearings, depth, or the observed traffic situation.
• Safe navigation depends on manual verification and cross-checking. Position must be confirmed using radar fixing, visual observation, and dead reckoning. Continuous cross-checking becomes essential, increasing workload and reducing margin for error in high-risk conditions.
• Orca AI operates independently of the GNSS feed, continuing to detect and track surrounding vessels visually, alert the bridge, notify shore teams, and warn approaching traffic when onboard positioning data cannot be trusted

What is GPS spoofing?

GPS spoofing (also referred to as GNSS spoofing) is the deliberate transmission of counterfeit GNSS signals engineered to override a vessel’s legitimate satellite fix, causing the receiver to compute false position, speed, and timing data without triggering any system-level fault or alarm.

How does GPS spoofing work?

• Counterfeit signals replicate legitimate satellite transmissions engineered to mirror the structure, frequency, and timing of genuine GNSS signals, making them indistinguishable to a standard receiver.
• Signal strength is gradually increased until the receiver abandons its authentic satellite lock and transitions onto the false source.
• The vessel is assigned a false position, manifesting as coordinates that place the vessel in the wrong location, missing position data, or, in more obvious cases, the ECDIS showing the vessel navigating over land.
• Navigation systems continue functioning without interruption – ECDIS, AIS, and autopilot all operate against the corrupted positional data

How does GPS spoofing affect vessel operations?

System-level impact

• GNSS feeds positioning into ECDIS, AIS, and radar overlays — a single corrupted GNSS input doesn’t stay isolated. It propagates instantly across every system drawing from that feed, meaning the vessel’s charted position, broadcast identity, and radar picture are all compromised from a single point of failure
• A corrupted position propagates across multiple systems simultaneously — rather than one system failing, the officer sees a consistent but false picture across the bridge. The consistency itself makes the corruption harder to identify
• Timing discrepancies can affect onboard systems that rely on synchronised data – GNSS is not only a positioning source. Many onboard systems use it as a timing reference. Spoofing-induced timing errors can affect dynamic positioning, voyage data recorders, and communications systems in ways that may not be immediately apparent

Bridge-level impact

• Incorrect vessel position relative to hazards or traffic — the ECDIS displays the vessel in the wrong geographic position, which means the relationship between own-ship and surrounding hazards, traffic, and navigational features cannot be trusted. A vessel may be significantly closer to danger than the chart picture suggests.
• Reliance on visual observation and radar becomes the primary navigation method — in open water and good visibility, this is manageable, but in restricted visibility, at night, or in high-traffic corridors, operating without a trusted GNSS fix places significantly greater demand on the watchkeeper
• Distorted CPA and TCPA calculations — if the own-ship position is false, all collision avoidance calculations derived from it are unreliable. Officers cannot trust ARPA-generated CPA and TCPA values without independently verifying own-ship position through other means
• Conflicting information between sensors — as the spoofed position diverges from reality, discrepancies begin to appear between GNSS-fed systems and independent inputs such as radar and visual bearings, creating a confusing and high-workload bridge environment
• Reduced confidence in the navigation picture — even once spoofing is suspected, the watchkeeper must continue navigating with degraded situational awareness, cross-checking every input manually until a reliable position can be established through independent means

Where GPS spoofing is occurring

GPS spoofing and GNSS interference are not isolated incidents. Activity has been observed across multiple regions, with vessels operating in dense and high-risk environments consistently affected.

High-traffic shipping corridors

Spoofing incidents are frequently reported in corridors where vessel density is high and positional accuracy is critical. The concentration of traffic, including conventional commercial vessels and less predictable movements from the shadow fleet, makes these areas both a target and a significant risk multiplier, where a single spoofing event can affect multiple vessels simultaneously.

Conflict-adjacent maritime regions

Waters bordering active conflict zones have seen the highest concentration of GPS spoofing activity. State and non-state actors deploy spoofing as both a defensive and offensive tool, with commercial vessels caught in the operational environment.

Strategic chokepoints

Narrow straits and chokepoints present the highest navigational risk when spoofing is active. Reduced sea room, high traffic density, and the precision required to transit safely make a corrupted position particularly dangerous in these areas.

How GPS spoofing is detected

• Cross-referencing GNSS position with radar and visual observations — the most reliable indicator of a spoofing event is a discrepancy between the GNSS-derived position and an independently obtained fix. Radar ranges and bearings to charted objects, visual transits, and depth contours can all reveal that the displayed position is inconsistent with the vessel’s actual surroundings
• Identifying inconsistencies between systems — as a spoofed position diverges from reality, subtle conflicts begin to appear across the bridge. AIS targets may not correlate with radar contacts. Charted depths may not match the echo sounder. These cross-system inconsistencies are often the first detectable sign of GPS location spoofing
• Detecting abnormal movement patterns or position shifts — a sudden jump in position, an unexpected change in SOG or COG with no corresponding helm or engine input, or a vessel track that doesn’t match the visual picture are all indicators that the GNSS feed may be compromised

GPS spoofing detection depends entirely on recognising discrepancies between independent sources. Unlike GPS spoofing software, which is designed to operate invisibly, the human watchkeeper remains the only reliable detection layer at the precise moment situational awareness is most critical, as the officer must simultaneously navigate, cross-check systems, and investigate anomalies. In high-traffic areas or restricted waters, that workload concentration is itself a serious safety risk.

How vessels can maintain safe navigation during spoofing events

When a spoofing event is suspected or confirmed, navigation must be validated through independent references. GNSS-derived data cannot be trusted until the discrepancy is resolved.

• Radar fixing against charted objects — ranges and bearings to charted landmarks, buoys, and coastal features provide a GNSS-independent position that can be plotted directly on the ECDIS or paper chart. In confined waters or near a coastline, this is the most reliable and immediately available alternative fix source
• Visual observation and lookout — a dedicated lookout becomes critical during a spoofing event. Visual bearings to fixed objects, light characteristics, and traffic in the vicinity all provide independent data points that can be used to validate or contradict the displayed position
• Dead reckoning — using last known reliable position, logged heading, speed, and elapsed time to project forward a best-estimate position. While accuracy degrades over time, dead reckoning provides a continuous position reference when all other sources are compromised
• Continuous cross-checking between systems — no single input should be trusted in isolation. Depth soundings against charted depths, radar contacts against AIS, visual observations against the plotted position — safe navigation during a spoofing event depends on treating every system as a single vote, not a definitive answer

Safe navigation depends on verifying position and traffic through multiple independent inputs. The vessel that maintains that discipline, even under normal conditions, is significantly better positioned to detect and manage a spoofing event when it occurs. But procedural vigilance alone has its limits — in high-traffic areas, restricted waters, or during periods of reduced visibility, the workload of manual cross-checking can quickly exceed what a watchkeeper can sustain.

This is where layered safety systems become critical. Technology that operates independently of the GNSS feed, continues tracking surrounding traffic, and alerts the bridge to spoofing in real time provides the additional layer that procedural methods cannot.

How Orca AI supports navigation under GPS spoofing

When GNSS data is compromised, decision-making depends on the quality of independent information available to the watchkeeper. Orca AI provides that independent layer — operating entirely outside the GNSS feed and continuing to function when onboard positioning data cannot be trusted.

• Detects spoofing and alerts vessels entering affected areas — Orca AI identifies spoofing by detecting inconsistencies between GPS inputs and other onboard navigation sensors. Data is processed and validated in the cloud, and once confirmed, an immediate alert is issued to the vessel via Co-Captain, notifying the bridge that GPS signal may be unreliable and prompting the system to switch to visual detection mode
• Continues detecting and tracking surrounding vessels based on visual detection — the Orca AI SeaPod digital watchkeeper detects and classifies all target types without relying on AIS signals or GPS data. Situational awareness of surrounding traffic is maintained independently of the compromised GNSS feed, giving the watchkeeper a reliable picture of the vessel’s actual environment
• Sends alerts to shore teams for fleet monitoring and support — spoofing alerts are surfaced automatically in FleetView, allowing operations teams ashore to monitor affected vessels in real time, support the bridge, and adapt fleet operations during the disruption

Sends alerts to vessels on the same route for early identification — spoofing alerts are shared through Co-Captain with nearby Orca AI-equipped vessels approaching the area, using the last verified position rather than manipulated coordinates.