How to Hack a Superyacht | The Walrus

Newsletters

Subscribe

Donate

Search

Sections

Latest Stories<br>Business<br>Environment<br>Society<br>Politics<br>Arts & Culture<br>View all categories >>

Explore

Newsletters<br>Events<br>Podcasts<br>Games<br>Magazine<br>The Walrus Lab

Support

Donate<br>Subscribe<br>Merchandise<br>The Walrus Plus<br>Annual Report<br>The Walrus Gala

Follow

Twitter<br>LinkedIn<br>YouTube<br>TikTok<br>Facebook<br>Instagram<br>Bluesky

About Us

Contact Us

My Account

Manage Subscriptions

-->

Skip to content

Nikldn (Unsplash) / iStock / Emery Forbes

The year the iPhone 3G came out, the one with the GPS chip installed and working Google Maps, Todd Humphreys spent a lot of time on the floor of his Bay Area apartment, surrounded by a jumble of wires and his three-year-old son Ramon. Humphreys had just moved with his family across the country to California to co-found a navigation startup based on GPS. (It was later acquired by Apple.) The startup job took up most of his time, but the reason for the wires on the beige carpet, plugged into a spread of laptops, switchboards, and radios, was pure curiosity. Humphreys and a college friend were trying to build something they believed had not yet been created outside of the military. They were building a spoofer.

A spoofer is, in a word, a fake. It co-opts a real GPS signal and replaces it with false information about where—and sometimes, at what time—the receiver is located. The “new” signal is far stronger, and when it meets the genuine signal, it takes over, bumping off the real signal like a wolf in sheep’s clothing. The trick here, like with any good act of forgery, is for the hijacking to be so seamless that the receiver never even realizes anything is wrong and so never raises the alarm. This is possible because, unlike the military signals, civilian GPS signals are not encrypted.

Spoofing is far more dangerous than jamming—blocking out the GPS signals until they are unusable—and it’s also far more complex. The risk of jamming was something the system’s architects understood from the very beginning of the GPS system, because the inherent weakness of the signals as they travel toward Earth means they can be drowned out by electromagnetic noise. But in 2008, as Humphreys was lying on his carpet in California, spoofing was still largely seen as a non-issue, especially outside conflict zones.

At the time, the conventional thinking was that spoofing “was generally considered too hard for the layman to do, and it would only be like a nation-state type thing,” says Sherman Lo, a senior research engineer at Stanford’s GPS Lab. “And if that happened, then the generally held opinion was that we have bigger problems.”

The spoofing idea came from a copy of GPS World published the previous year, in July 2007. Flipping through the magazine, Humphreys stumbled on a column written by Logan Scott, a consultant who got his start in the GPS world working on receivers for Texas Instruments. Scott was arguing that when it came to mass spoofing, it was only a matter of time.

Maybe someone wanted to illegally overfish, adding tens of thousands of dollars to their crab or shrimp catch, by covering up their tracks. Or maybe they’d like to dump some toxic waste or other hazardous material. The incentives were there—and so was the technology. Even in 2007, Scott argued that a credible spoofer could be developed for less than $10,000 using off-the-shelf parts. Once spoofing started at scale, it would also be inherently difficult to stop, he pointed out.

Scott had already begun working on a system to “authenticate” civil GPS signals while raising the alarm, despite what he says was the consistent refrain from the United States government that spoofing would be too hard for civilians to carry out. But the response to his proposal was that signal authentication was not needed, he says. This was when he started thinking of his efforts as “Project Cassandra,” after the Trojan princess from Greek mythology who was cursed to make accurate prophecies that no one would believe.

By the time Humphreys had finished reading the column, he recognized the inherent challenge it contained. He would build a spoofer and prove Scott right. One year later, on his carpet in California, his “Dr Frankenstein moment” finally arrived.

“What I then saw in that little blue dot was the potential for chaos.”

That evening, Humphreys decided the spoofing equipment was at last ready to be tested. He picked up his iPhone and opened up Google Maps. There he was, a tiny blue dot, positioned serenely on the grid of his residential neighbourhood.

Then he turned on the rogue fake signal from his spoofer and watched as the dot on the screen appeared to race off down his street, heading north.

“What I then saw in that little blue dot,” he later said, “was the potential for chaos.”

GPS had become seamlessly enmeshed into almost all areas of everyday life, and the arrival of the iPhone had only sent that dependence into the stratosphere. It had...