Who cares about the Baltic Jammer?: Terrestrial Navigation in the Baltic Sea Region

Who cares about the Baltic Jammer?: Terrestrial Navigation in the Baltic Sea Region

Speakers: Niklas Hehenkamp, Lars, Markus

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=X1qSpCjadmw

Overview

This talk, presented by researchers from the German Aerospace Center (DLR), delves into the critical vulnerabilities of Global Navigation Satellite Systems (GNSS), such as GPS and Galileo, particularly in the context of recent widespread jamming and spoofing incidents in the Baltic Sea. The speakers, Niklas Hehenkamp, Lars, and Markus, outline the pressing need for a resilient, independent backup to GNSS and introduce their innovative solution: the R-mode (ranging mode) terrestrial navigation system.

The core of the presentation focuses on developing and validating a ground-based positioning, navigation, and timing (PNT) system that leverages existing maritime infrastructure. This initiative, initially conceived as a civilian backup against minor GNSS outages, has gained significant urgency due to the "phantom menace" of persistent, large-scale interference observed in the Baltic Sea. The DLR team presents a compelling case for moving beyond sole reliance on satellite navigation by demonstrating a practical, robust, and civilian-controlled alternative designed to withstand the very threats currently challenging maritime and aerial operations in the region.

Background

▶ Watch: Introduction and significant GNSS jamming in Baltic Sea (0:00)

For nearly two years prior to this talk, the Baltic Sea region has experienced significant and persistent GNSS jamming and spoofing, a phenomenon the speakers aptly term the "phantom menace." Media outlets have extensively reported on these disruptions, which have led to temporary airport closures and numerous concerning incidents for vessels. The widespread impact stems from the heavy reliance of modern air and maritime traffic systems on precise GNSS data. Investigations, including those by GPSPatron and the Gdynia Maritime University, have identified multiple, coordinated interference sources, highly likely originating from the Kaliningrad oblast and attributed to Russia. These attacks involve both GNSS wideband jamming and persistent GPS L1 spoofing, where signals are manipulated to make ships believe they are located in Kaliningrad, regardless of their actual position.

The ease with which such attacks can be executed is a sobering revelation. The speakers demonstrate that anyone with readily available hardware, such as a software-defined radio (SDR) like the HackRF, and open-source software like GPS-SDR-SIM, can generate spoofed GNSS signals. This accessibility underscores the critical vulnerability of relying on a single, easily disrupted technology for fundamental navigation.

In response to this growing threat, various backup solutions have been proposed. The European Space Agency (ESA), for instance, is developing Celeste, a system combining low-Earth orbit (LEO) satellites with Galileo. While LEO satellites offer stronger signals (reportedly 1,000 times stronger than traditional GNSS signals due to their lower altitude of around 160 kilometers), the DLR researchers express technical criticism. They argue that even a thousand-fold increase in signal strength still results in a relatively weak signal compared to terrestrial transmissions, making it susceptible to the same jamming and spoofing techniques, albeit requiring slightly more powerful interference. This highlights a fundamental design philosophy: true resilience often requires a departure from the very architecture that enables the primary vulnerability. The DLR team's work, therefore, focuses on a fundamentally different approach: high-power, terrestrial signals that are inherently more difficult to disrupt.

Key Findings

▶ Watch: German MoD attributes Baltic Sea jamming to Russian origin (2:50)

The DLR team's research underscores several critical findings regarding navigation system resilience and the viability of terrestrial alternatives:

• GNSS as a Single Point of Failure: The ongoing jamming and spoofing in the Baltic Sea unequivocally demonstrate that global navigation satellite systems constitute a single point of failure for critical infrastructure, making them highly vulnerable to both intentional attacks and unintentional disruptions (e.g., solar activity).
• Superior Resilience of Terrestrial Signals: Terrestrial navigation systems employing high-power signals prove significantly more resilient to jamming and spoofing than satellite-based systems, including proposed LEO constellations. Disrupting these ground-based systems would require substantially larger antennas and more material resources, making widespread, coordinated interference much more challenging.
• Repurposing Existing Infrastructure: The research successfully demonstrates that existing maritime infrastructure, specifically the Medium Frequency (MF) beacon system and the VHF Data Exchange System (VDES), can be effectively repurposed to create a robust, civilian-controlled backup PNT system, known as R-mode. This approach significantly reduces the cost and complexity of deployment compared to building entirely new infrastructure.
• Achievable Accuracy for Maritime Needs: The R-mode system can provide positioning accuracy well within the standards required for maritime navigation. MF R-mode achieves a 95% accuracy of 12 meters during the day and 63 meters at night, while VDES R-mode delivers approximately 10 meters accuracy in coastal areas.
• Criticality of Ground Wave Propagation Modeling: For MF systems, accurate modeling of ground wave propagation is paramount to achieving high positioning accuracy. The DLR team developed an advanced method using global harmonized data sets and integral equation methods to precisely compute ground conductivity and permittivity, correcting signal delays.
• Challenges of Standardization: While technically feasible and demonstrably effective, the international standardization process for new navigation systems, particularly regarding frequency allocation, is a slow and bureaucratic hurdle that significantly impacts operational deployment timelines.

Technical Deep Dive

▶ Watch: Emphasizing the critical need for a resilient backup system (4:20)

The R-mode system developed by the DLR team is a terrestrial navigation system designed to provide backup Position, Navigation, and Timing (PNT) services, offer resilience against GNSS jamming and spoofing, and facilitate the detection of GNSS interference. It achieves this by leveraging two distinct, existing maritime communication infrastructures: the Medium Frequency (MF) beacon system and the VHF Data Exchange System (VDES).

MF R-mode: Harnessing Kilometer Waves

The MF R-mode operates at approximately 300 kHz, corresponding to kilometer-long wavelengths. This low-frequency band is crucial because its signals propagate as ground waves, following the curvature of the Earth along the surface of the atmosphere and ground, rather than being limited to line-of-sight. This characteristic allows for extensive coverage, with base stations capable of reaching up to 300 kilometers depending on transmitted power and antenna configuration.

The core idea is to augment existing MF beacon signals, which are typically narrow in bandwidth, by adding two tiny, synchronized continuous wave (CW) signals. These CWs, transmitted from different stations, are precisely timed using rubidium clocks at the base stations. A dedicated receiver then estimates the phase of arrival of these synchronized signals to determine the receiver's position.

A significant technical challenge for MF R-mode is accurately accounting for ground wave propagation delays. These delays are influenced by the conductivity and permittivity of the ground over which the signal travels. Initially, researchers relied on outdated and non-machine-readable ground conductivity maps provided by organizations like the ITU. To overcome this, the DLR team developed a novel approach:

1. Data Harmonization: They utilize global harmonized data sets on soil texture.
2. Environmental Variables: Satellite remote sensing data is integrated to gather environmental variables such as salinity of the Baltic Sea, soil moisture, and surface temperature.
3. Electromagnetic Field Computation: All this data is fed into an integral equation method to compute the electromagnetic field and generate a high-accuracy, global ground conductivity map. This process yields a "correction picture" containing information on ground wave propagation delays, which is stored in the receiver to correct any additional delays, thereby enhancing positioning accuracy. This sophisticated modeling is critical for translating raw phase measurements into precise positional data.

VDES R-mode: Coastal Complement at VHF

Complementing the MF R-mode is the VDES R-mode, which operates at a higher frequency of 160 MHz in the VHF band. VDES is an extension of the Automatic Identification System (AIS), designed to provide more capacity and bandwidth (100 kHz compared to AIS's 25 kHz). Unlike MF, VDES signals are primarily limited to line-of-sight propagation, making them suitable for coastal areas, typically offering coverage from 20 to 100 kilometers from the coast.

For VDES R-mode, the system not only estimates ranges but also observes Doppler shift, which provides information about the relative movement towards the stations. This dynamic tracking capability, when integrated into a tracking filter, further refines positioning results.

Receiver and Processing Architecture

The DLR team's receiver development has evolved from early, improvised setups (cables on a vessel, GPS-disciplined clocks in cardboard boxes) to robust, mobile systems. Initial test setups used software-defined radios (SDRs) coupled with front-end components (antennas, low noise amplifiers, filters) and general-purpose PCs for processing. The goal was to collect as much raw data as possible for post-processing and algorithm refinement.

Modern iterations include compact, portable boxes housing the SDR and necessary components, designed for easy deployment on vessels with a laptop. The processing for the continuous waves in the MF band involves advanced mathematical techniques, including windowing in spectral analysis to minimize noise and optimize the estimation of the narrow CW signals. The flexibility of SDRs even allows for rudimentary positioning with readily available devices like RTL-SDR sticks (with appropriate filters) or even oscilloscopes capable of sampling at 300 kHz.

Time Synchronization

Precise time synchronization is fundamental to both R-mode systems. Base stations utilize highly stable rubidium clocks to ensure synchronized signal transmission. For receiver testing and comparison, GPS-disciplined clocks provide accurate frequency and time references. The speakers explicitly state that simpler time sources like DCF77 are not accurate enough, as the system requires nanosecond precision, whereas DCF77 typically offers microsecond accuracy. Advanced time transfer over fiber optic networks is also explored as a potential solution for remote station synchronization.

The development process has involved extensive international collaboration with institutions from Germany, Poland, Denmark, Norway, Sweden, Finland, Estonia, South Korea, and Canada, actively driving international standardization for this critical civilian backup system.

Demo / Proof of Concept

▶ Watch: Proposing terrestrial navigation using existing maritime infrastructure (7:05)

The DLR team has rigorously tested and demonstrated the R-mode system through various trials, showcasing its capabilities in both maritime and aerial environments.

For MF R-mode, initial trials date back to 2014-2015, with a pre-operational R-mode testbed established in the Baltic Sea since 2017. This testbed utilizes existing MF transmitters, augmented with rubidium clocks and newly developed signal modulators to transmit time-synchronized navigation signals. During a demonstration in the Gdansk Bay, a vessel equipped with the R-mode receiver sailed while simultaneously using GNSS. The MF R-mode derived track was compared against the GNSS reference. The results showed a remarkable 95% accuracy of 12 meters during daylight hours. However, due to additional propagation paths caused by ionospheric reflection at night, accuracy degraded to around 63 meters. Despite this nighttime reduction, both accuracy figures are well within the standardization requirements for backup solutions for large vessels, which can easily be 200 meters long.

The VDES R-mode underwent separate testing, initially on Lake Ammersee near Munich. Using a boat equipped with an SDR-based receiver and three transmit stations (each with a high mast, antenna, and GNSS reference for timing), the team estimated ranges and Doppler shifts. When these observations were fed into a tracking filter, the system achieved positioning results with approximately 10 meters accuracy. The dynamic tracking capabilities, leveraging Doppler observations, allowed for accurate tracking of complex maneuvers, including closely driven loops.

Beyond maritime applications, the DLR team also explored aerial integration. A motor glider, typically used for aerial observation flights, was fitted with an SDR receiver and a small antenna. Tests were conducted over Hamburg, utilizing three VDES transmit stations located at DLR, Fraunhofer, and the BSH (Bundesamt für Seeschifffahrt und Hydrographie). While the aircraft performed its regular camera patterns, it also executed specific circles for R-mode tracking. For the aerial platform, the system achieved an error of about 200 meters. The researchers are actively investigating the causes for this higher error, considering factors like different dynamics or specific adaptations needed for airborne use cases.

Currently, the team is establishing a semi-permanent VDES R-mode test field on the island of Rügen. This field marks the first integration of commercial hardware, with an industry partner building base stations that incorporate the VDES R-mode as a prototype option. This move towards commercial integration signals the system's readiness for broader deployment. The third station for this testbed is expected to be operational early next year, further solidifying the pre-operational status of R-mode.

Defensive Implications

▶ Watch: Key goals: backup PNT, jamming resilience, interference detection (8:20)

The development and deployment of the R-mode system carry significant defensive implications for critical infrastructure reliant on PNT, especially in regions prone to GNSS interference.

1. Diversification and Redundancy: The most fundamental defensive implication is the principle of diversification. By providing an independent, terrestrial backup to GNSS, R-mode eliminates the single point of failure that currently plagues global navigation. In scenarios where GNSS signals are jammed or spoofed, R-mode ensures continuity of PNT services, preventing operational disruptions and enhancing safety for maritime and aerial traffic.
2. Enhanced Resilience to Attacks: Terrestrial, high-power signals, particularly those in the MF band, are inherently more difficult to jam or spoof than weak satellite signals. Disrupting MF R-mode would require massive, specialized antenna infrastructure and significant power, making it impractical for widespread, clandestine attacks. While VDES R-mode (VHF) is still susceptible to localized jamming, its higher power and coastal coverage offer better resilience than GNSS in its operational area.
3. Interference Detection: The presence of an independent backup system like R-mode provides an immediate and unambiguous mechanism for detecting GNSS interference. If a vessel's GNSS position diverges significantly from its R-mode position, it's a clear indicator that one of the systems is compromised, likely GNSS. This allows operators to switch to the reliable R-mode or take other precautionary measures.
4. Localization of Attackers: The underlying technology used for R-mode—precise signal reception and time-of-arrival estimation—can be inverted to locate sources of interference. As discussed in the Q&A, if three base stations receive an anomalous AIS signal (or a jamming signal), the same principles could be applied to triangulate the signal's origin, thereby assisting in identifying and potentially mitigating malicious actors.
5. Civilian Control and Independence: R-mode is designed as a civilian system, allowing individual nations or even smaller entities to operate and maintain it independently. This decentralization reduces reliance on military-controlled or large international systems, enhancing national sovereignty over critical navigation infrastructure and ensuring its availability even during geopolitical tensions. It empowers countries to manage their own PNT resilience.
6. Cost-Effectiveness and Rapid Deployment: By reusing and adapting existing maritime infrastructure (MF beacons, VDES base stations), R-mode offers a cost-effective solution compared to building entirely new networks from scratch. This facilitates quicker adoption and wider deployment, strengthening the defensive posture more rapidly.
7. Standardization as a Defensive Enabler: While bureaucratic and slow, international standardization is crucial for the widespread adoption and interoperability of R-mode. A globally recognized and standardized backup system ensures seamless navigation across borders and promotes collective security, making it harder for adversaries to exploit localized vulnerabilities.

In essence, R-mode represents a strategic shift towards a multi-layered, resilient PNT architecture that is less susceptible to the asymmetric threats posed by GNSS jamming and spoofing, providing a vital safeguard for modern navigation.

Key Takeaways

• GNSS Vulnerability: Global Navigation Satellite Systems are critically vulnerable to jamming and spoofing, as demonstrated by persistent attacks in the Baltic Sea, necessitating robust backup solutions.
• Terrestrial Resilience: Terrestrial navigation systems like R-mode offer significantly greater resilience against interference compared to satellite-based alternatives due to their high-power signals and ground-based infrastructure.
• Infrastructure Reuse: R-mode cost-effectively leverages existing maritime infrastructure (MF beacon systems and VDES) for deployment, avoiding the need for entirely new, expensive build-outs.
• Accurate Maritime PNT: The system provides reliable positioning, achieving 95% accuracy of 12 meters (day) with MF R-mode and approximately 10 meters with VDES R-mode in coastal areas, meeting maritime navigation standards.
• Advanced Propagation Modeling: Achieving high accuracy with MF R-mode relies on sophisticated modeling of ground wave propagation, integrating global soil data and satellite remote sensing.
• Civilian and Independent: R-mode is designed as a civilian, independent system, empowering nations to operate their own resilient PNT infrastructure and detect GNSS interference through divergence.
• Pre-Operational Status: The R-mode system is on track to be pre-operational by 2026, with active international standardization efforts underway to facilitate its widespread adoption.

About the Speaker(s)

The talk was delivered by a team of researchers from the German Aerospace Center (DLR).

Niklas Hehenkamp is affiliated with the German Aerospace Center, specifically working within the Institute of Communications and Navigation in the Nautical Systems Department. His work is based in Neustrelitz, in Mecklenburg-Vorpommern.

Markus also works at the German Aerospace Center but is based in a different department, located near Munich, at Oberpfaffenhofen.

Lars is also part of the research team from the German Aerospace Center, collaborating with Niklas and Markus on the R-mode project. While his specific department or location was not detailed in the introduction, his involvement highlights the collaborative nature of the DLR's research efforts.