GPS: A backbone for critical infrastructure.

Ethan Cook: I googled how does GPS work?

Maria Varmazis: Yeah.

Ethan Cook: And the technical definition that I got was, "a receiver measured the time it takes for a signal to travel from multiple satellites to your device."

Maria Varmazis: Yes.

Ethan Cook: "Then it measured that it multiplies the travel time by the speed of light to calculate the precise distance to each satellite. And then by analyzing them from at least four different satellites, the receiver then determines the three-dimensional position, latitude, longitude, and altitude and time."

Maria Varmazis: And time. The time is really important. Yes. Welcome. I'm Maria Varmazis, and you're listening to "T-Minus Space-Cyber Briefing." In this show, we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects, and connects our lives. Hi, everybody, and thank you for joining me today. In last week's show, we spent some time thinking about the future of GPS and how to secure it. This week and next, we thought we'd take a little step back and spend some more time looking at GPS in general and why in the heck it matters in a space cyber context. Spoiler alert, it matters a lot, perhaps a lot more than you would think. So, let's dive in. And by the end of this episode, you'll have a better understanding of where and how attacks against GPS signals fit into the modern threat landscape. Producer Ethan Cook joins me once again to break it all down. All right. So, hi, Ethan. Welcome back. I didn't scare you away last time.

Ethan Cook: No, you did not. I am here. I'm back.

Maria Varmazis: All right. So, we've been talking a lot about GPS, good old GPS, in our editorial discussions. And when we're talking about like booking people for the show, it feels very inevitable that we're going to go back to it a bunch.

Ethan Cook: It's kind of important.

Maria Varmazis: Kind of important. Also, I think people think they know a lot about it and maybe have a different idea of what the actual reality is. But anyway, before we get into all that, for context for our listeners, I've been in the space world and the GPS world like pretty hands-on, pretty heavily the last few years. You've been doing a ton of research as we've been sort of figuring out how we're going to cover GPS over the next couple of episodes. So, you're a little newer to it. And I'm very interested in hearing, as we go through sort of our conversation, what surprised you, you know, things that you thought were one thing but actually were another. I think a lot of people are going to be with you on that.

Ethan Cook: Yeah, I've been, you know, dusting off those old college research skills. Crazy stuff.

Maria Varmazis: Ooh-yeah. Yeah, it's every time I think I know something about GPS, I often find that I was just straight up wrong. So, I guess let's take people on that journey with us.

Ethan Cook: Yeah.

Maria Varmazis: Let's learn about GPS because it's-- I mean, it's not just the thing on your phone. It's not just like the old school TomTom or Garmin that you had in your car.

Ethan Cook: No, it's not a map feature.

Maria Varmazis: It's yeah. So, I feel like the best way to start talking about GPS, my favorite thing to do is just ask people randomly how does GPS work and just hear their responses. And I feel like it's cheating asking you this because you kind of know how it works now. But--

Ethan Cook: A little bit. The week ago explanation would have been, a phone connects to the satellite. Satellite tells me where I am, and then magic happens and I go to a location.

Maria Varmazis: That is how everyone describes it.

Ethan Cook: You know, like a week ago, I was like, "Why do I need to know anything more than that?" Like what could ever be relevant to that?

Maria Varmazis: Yes.

Ethan Cook: For example, like I guess a good way to think about that would be if you are, let's say driving using a map feature or navigation feature, it's being able to tell you not only actively where you're moving to and in live real time and the positioning aspect, but like how far away you are and estimating is the kind of concept I got as well as in a time sensitive system being able to be like, let's say for finances, being able to say like, "Okay, this person is in the correct location and they're paying within a sensitive timeframe." That's to make sure that this is an authentic use of GPS. That's the rough concepts that I've gotten over the past, like three days of shotgun research. So--

Maria Varmazis: Okay. I hear some things in there that sound right. And a few things that I'm like, I'm not sure that's correct. So I--

Ethan Cook: Okay, well let's go for it.

Maria Varmazis: Because-- so my, my main thing is we're not talking to the satellites with GPS. That's the thing that I think everybody thinks is like, we're communicating with them. It's like, we're just listening to what they're telling us. And that people think that the satellite also tells you how to navigate. And it's like, nope, the satellite doesn't tell you any of that. That's all your phone and your phone, plus the cellular networks all working together. There's a lot of stuff happening on the software level on your phone that's doing all that navigation. The GPS is not thinking that part for you. That is a totally different world. So that-- all right. So we've just said like what it isn't.

Ethan Cook: Okay. Well, there we go.

Maria Varmazis: So what-- maybe should we start with what the heck GPS actually is?

Ethan Cook: Yeah, absolutely. Yeah. That's a good start. I've learned it's a part of-- it's a very small part of a very large ecosystem.

Maria Varmazis: It truly is. So this is Maria's putting on her explaining hat now. So Professor Maria has entered the building. So there are a lot of different satellite constellations or groups of satellites that exist in what's called like geostationary orbit or like way out there in orbit, not as close to Earth as low Earth orbit is. Yes. So essentially, like the stuff that we talked about with Starlink or the International Space Station, those are in low Earth orbit. That's pretty close to Earth. That's like a couple hundred kilometers from Earth. All these global navigation satellite systems, and there are many around the world, operated by many different countries, of which GPS from the United States is the first. They're way, way, way far out there. But like the United States, we have GPS, Europe has Galileo. So that's their own version. And they're all slightly different from how we do things. Russia has one called GLONASS, India has NavIC, China has BeiDou, and Japan has QZSS. And like we all use each other's, we all ping off of each other's, and all of these different global navigation satellite services, or GNSSs, like we can see all of those signals; they all work slightly differently, but they're all just blasting the signal out. Just kind of going. >> Here I am. Here I am. Here I am. Here I am. Here I am. So there is a lot of physics that goes into this. And yes, the speed of light comes into this. And if people go, what-- how is any of that relevant? It's super relevant. The part about GPS satellites being far away from Earth is actually really important because there's a delay between when the satellites send their signal about where they are and what time they think it is versus when we receive that here on Earth. And that delay is super-duper, duper minuscule, but it is there.

Ethan Cook: It is important.

Maria Varmazis: Yeah. And it's like, we humans can't perceive it, but our machines sure can.

Ethan Cook: If you ever asked any cyber professional about RTP and, you know, the impacts that desynchronizing that could have on just an individual network? The catastrophic would be the answer, depending on how big that network is.

Maria Varmazis: I mean, that right there, what you said, Ethan, is like the whole reason why we on the Space-Cyber podcast are talking about GPS, because as cool as GPS is in terms of global infrastructure and the things that cybersecurity professionals are going to be really interested in. It's not the location stuff. It's the timing. The timing is so crucial. And yes, as you said, if you mess with that, you monkey with that in any way, a lot of stuff's boned. I don't know how to put it.

Ethan Cook: It's a catastrophic, you know, impact on a lot.

Maria Varmazis: It is. It truly, truly is. And I think when we have our next episode, we're going to get into a lot of the how that works a little more specifically. So spoiler alert for that one. But that is a bit of a preview of what we're going to get into. But yeah, so essentially, going back to like the physics of all this works. The key thing is that, again, as you said, the satellite is blasting out a location, the latitude, longitude, altitude, and time. That's it. And then from there, we can do a whole bunch of trilateration. Our devices can do that. The receivers on the ground can do that. So that can be our phone that's receiving that. If you're on a boat, your boat's receiver can do that.

Ethan Cook: Infrastructure equipment.

Maria Varmazis: It can do that. Yes, very importantly. And so all that heavy thinking is being done by the device once it receives that key information. And so we receive in the United States signals from GPS. If you're in Europe, you're probably getting them from Galileo. But we can actually get signals from a whole bunch of different GNSS systems at once. Basically, the key thing is we're getting these signals and that tiny, tiny delay from the radio waves, the way that the signals are getting to Earth. Since radio waves are a form of light, we can use the tiny delay with the speed of light to figure out, okay, if the delay is this and it says this and that, we've got a whole bunch of overlapping spheres of where the satellites are. We can sort of figure out position from there. That is a very poor physics explainer.

Ethan Cook: It's better than trying to go through, as what I did, which is read 10 articles where they're throwing out very big words. And I'm like, I don't know what's happening here.

Maria Varmazis: Yeah, the moment you see a formula, you're like, oh, no.

Ethan Cook: I'm like, oh, no.

Maria Varmazis: The physics is beautifully explained on the Internet by people much more in depth on the physics side of things than us. So we'll just hand-wave that a little bit. But that whole process is trilateration.

Ethan Cook: Yeah.

Maria Varmazis: Not triangulation.

Ethan Cook: No.

Maria Varmazis: Trilateration. Yeah. And crucially, these signals are actually pinged out in a sphere from the GPS. So they're kind of there, you know, because they're in space. They're not just blasting it down in a line. They're putting out all these signals spherically. So you can actually do some really interesting things with that if you're not just on Earth. But that might be a different show entirely. You know what? We should probably take a quick break.

Ethan Cook: You know, I agree.

Maria Varmazis: All right. So, dust off those Pogs and bust out a can of Sobey because we are going back to the '90s after this break. [ Music ] OK, and we're back. But if you imagine these signals from at least three different GPS satellites sort of overlapping like a Venn diagram, you can imagine pretty quickly, depending on where you are, you can-- you're at the intersection of a whole bunch of different signals, and you're using the delay to be like, oh, here I am. If you were in the military in the '70s and '80s and '90s, especially that would put you way ahead of being able to figure out where you were. That's actually why the whole thing was invented was for military use.

Ethan Cook: As with everything.

Maria Varmazis: As with everything. And this is actually something that surprised me. It started in 1978.

Ethan Cook: Yeah. You know, it makes sense from like just like I'm a big history guy, you know, from the time period being how much we were investing in space and the amount of moon launches, et cetera, that satellites, especially with the race with the Soviets at the time, being a very, very competitive dynamic, especially with, you know, some minor proxy wars going on.

Maria Varmazis: Yeah. Cold War, what the heck is that? Yeah. Yeah. It does make sense, doesn't it, given the time. And I mean, we were just starting to see-- I mean, we had been to the moon by that point. The space shuttle program was starting to ramp up at that point. And Skylab, I think, had already happened. Like, so cool stuff was happening in space at that time in the late '70s. And we weren't just going, satellites are really good for taking pictures from far away and making beep beep sounds and maybe transmitting things like, we were like, oh, maybe they can do other stuff. So, but yeah, I would not have guessed 1978. That's still way back further back than I would have guessed.

Ethan Cook: Yeah, I would probably have-- I would have said the '80s would be my gut instinct if I had to put a pen down on it. But I could see late '70s being like the tail edge of where I would have gone for. I think from at least now, from my research, what was interesting was, you know, as with everything, the military does some massive investment, has this very advanced technology, and then inevitably gets a new one. But the previous one has a ton of both commercial and civic uses that can do a ton of wonders for us. The Internet is one of them, for example.

Maria Varmazis: Thank you, DARPA.

Ethan Cook: Yeah, exactly.

Maria Varmazis: I'm pretty sure on my tombstone is just going to say, "Thank you, DARPA, for the Internet." Because I say it all the time, which is the weirdest thing to put on your tombstone. But I love the Internet.

Ethan Cook: You know, it's quite wonderful. But I think I didn't realize I knew that GPS was originally started by the military, but I didn't realize that it was Clinton and Gore who, like, it seems like, opened it up for commercial use.

Maria Varmazis: Isn't that the weirdest thing? So I didn't realize that either. And I was alive at this time. I feel like I should have remembered.

Ethan Cook: I think that so was I.

Maria Varmazis: Yeah, technically.

Ethan Cook: So I was like three or four.

Maria Varmazis: I was going to say, you don't remember. I was old enough to remember this. But yeah, 1994, GPS got opened up for civilian use, technically, like technically. But nobody was using it in the '90s for a couple of reasons. I mean, okay, not nobody, it wasn't really widely used. We didn't have smartphones at that time. So I mean, there's that. GPS being opened in '94 by the Clinton administration was what they called selective availability for civilians. And so the accuracy was down to 100 meters, which I think basically told you essentially what state you're in.

Ethan Cook: You know, you could be in one of the tri-state area locations.

Maria Varmazis: Yeah. I'm like, I'm in New England, so I'm in one of the five New England states. It doesn't do much for me. Like, OK, great.

Ethan Cook: I guess if you're in center Texas, it still knows that you're in center Texas.

Maria Varmazis: Yeah. Yeah. You're still in Houston. You're still in Houston. You're still in Houston. Yeah, that's really-- I mean, it's better than nothing, but certainly was not the accuracy level that the military was getting. But I understand why they didn't open it up. But yeah, it was like one of the last things I think Clinton did on his way out the door in 2000 was saying, you know what, I think actually this would be more helpful if we get rid of the selective availability.

Ethan Cook: Yeah. Let's go crazy with it.

Maria Varmazis: Let's go crazy. And then we civilians got 10 meters of accuracy from GPS signals.

Ethan Cook: Which is, you know, that's a pretty big improvement from 100 to 10.

Maria Varmazis: Do the math.

Ethan Cook: It works.

Maria Varmazis: Do the math. So, yeah, that I mean, we still didn't have-- we did not have smartphones at that time, but we did have cell phones-ish. Kind of. I mean, I had a cell phone.

Ethan Cook: They were devices.

Maria Varmazis: I had a Nokia brick. I don't think it had anything GPS yet at that time.

Ethan Cook: It probably still functions, though.

Maria Varmazis: If I could find it.

Ethan Cook: If you found it, it probably still works.

Maria Varmazis: Oh, man. Oh, I did so much work on like programming my ringtones in that thing. It was a whole-- Yeah. And like I had a little charm that would light up when the phone was about to get a call.

Ethan Cook: Incredible.

Maria Varmazis: Yeah, it was. I'm sure that was great for my body to have that. Anyway, but, yeah. Yeah. I mean, it did not have a GPS receiver on that phone that I remember back then. But once we started getting smartphones in what, 2006, was that the year officially iPhone came out, something like that?

Ethan Cook: Around that around then?

Maria Varmazis: Around then?

Ethan Cook: Yeah. Late to early to late to mid early 2000 era. >> Yeah, around era. Yeah, I mean, and concurrently, we also had devices like the Garmins and the TomToms and that satnav. I remember people had the satnav devices that would sit on the dashboard of their car. That was like a whole separate thing. You're Googling it out right now, aren't you? Yeah. The first iPhone was released in 2007.

Maria Varmazis: 2007. I was off by one. What can you do?

Ethan Cook: You piqued my curiosity.

Maria Varmazis: Yeah, yeah. But yeah, that, I mean, once we started getting it in our phone, because we had smartphones that were capable of really doing something with it. I mean, then it really took off.

Ethan Cook: Yeah.

Maria Varmazis: But I think industries that became dependent on it, I want to say that that started a little earlier, but it was much more behind the scenes. But that said, I mean, where we're at right now, now with that civilian use is basically at the same level of military use as far as we all know anyway. I mean, agriculture, you mentioned it earlier, like so much of agriculture depends on being able to locate where your machinery is in the world and how it's, you know, plotting its way around the fields. The energy sector uses GPS for a whole lot of stuff, like pipelines, you know, just being able to monitor situations and get a sense of how things are going. Surveying uses it a lot. I mean, finance, finance uses it for timing transactions. If we mess up GPS signals in the arena of how finance uses it, the global finance sector could collapse pretty quickly.

Ethan Cook: It is a minor hiccup day. Probably not good for everyone.

Maria Varmazis: Yeah, not great. So for the InfoSec professional who's like, why on earth are you spending all this time talking about GPS? The ephemeris data that GPS sends, the latitude, longitude, and altitude, and the time, all very good stuff, but it's the timing.

Ethan Cook: Taking it to a cyber actor level, being able to commit fraudulent transactions that look legitimate would be devastating. See, if you have the right credentials and are able to then manipulate the timing, you could get in, make it look legit, make it look all real. And you would probably also go undetected for some time because it looks so real.

Maria Varmazis: You could overwrite something by just kind of essentially time traveling your transaction.

Ethan Cook: Exactly.

Maria Varmazis: Yeah. Yeah. It's pretty dastardly when you start thinking about it like, oh, I'm sure financial folks are like, yeah, listen, we're 20 years ahead of you. We've been working on this to proof ourselves against this. But yeah, just the potential there.

Ethan Cook: You would hope at least.

Maria Varmazis: Yeah. Well, I mean, otherwise we just gave a lot of people a whole retirement plan and a really good idea. But no, it's yeah. I mean, the financial systems alone, they have, I know, a whole bunch of fail-safes against this kind of thing. But it is a pertinent threat. The other one that I didn't quite realize was for us civilians, our cellular networks, if they get out of synchronization, again, this has nothing to do with how we navigate in the world. This is just like how our phones work. Data throughput could degrade, calls would drop, and then also become out of sync, which at the very least would be extremely annoying.

Ethan Cook: Yes

Maria Varmazis: But I could imagine like that is annoying when it happens, but--

Ethan Cook: We need to scale it up to the business level, right? Like, if you say, okay, yeah, on the individual, like my daily needs probably would be annoying. You know, I would equate it to like a standard cell outage; you're like, "Man, that's really irritating. I wish this wasn't happening." But you're fine. But then you take that, and you scale that up to, okay, let's say it impacts, you know, a whole state, the whole state government can't function now for a day. Like, that's unacceptable. Like we can't have that happening. Or a power grid, you know, it goes down, or let's even take a worst-case scenario, an emergency happens, flooding, earthquake, tornado. Now we can't get emergency services out. We don't know where people need to go. It just scales that up and the risk factor up for providing support and being able to ensure that services are that we have available are actually able to function the way we want them to.

Maria Varmazis: Load balancing apparently for power grids and phase synchronization, which I don't quite understand what those are aside from those sound important to me. And I don't want those things to not work. Those need GPS timing signals. So the grid goes down. That's bad. I mean, I can understand on that level.

Ethan Cook: Yeah.

Maria Varmazis: I need power.

Ethan Cook: Yeah, it's kind of important for modern society.

Maria Varmazis: Yeah. And then I think the most obvious one and probably ties into what you said at the very top of this episode was data centers, server farms, you know, synchronization. Yeah.

Ethan Cook: When I think you hop into the cloud and, you know, the more we have gotten away from, and for very good reasons, by the way, this is not me pooh-poohing, you know--

Maria Varmazis: Bring back everyone owning their own server farm.

Ethan Cook: Exactly.

Maria Varmazis: No, no. I mean--

Ethan Cook: You know, like for very valid reasons that we have migrated to the cloud for many, many organizations. And obviously, as AI continues to expand up and that if we even further invest in these massive data centers that are not internalized at all, that is going to, while give us a ton of technological advancements, also does very much open the door to single points of failures. And that is something that is obviously not something that people are unaware of. People talk about it, but--

Maria Varmazis: Every time AWS East goes down, pretty much all of us get a day off from work.

Ethan Cook: Exactly. Right. Like, but that's going to be one of those things that I think when you talk about GPS, it's a conversational point that has to be included. And it will only grow more included because those impacts are now going to be felt way, way more. And it's why some of these concerns have been growing over the past five years.

Maria Varmazis: I think we're going to end this episode right there. We've talked a little bit about the nature of what could go wrong and why that would be very bad.

Ethan Cook: Yeah.

Maria Varmazis: So what are the actual threats and how would they work against GPS signals? We'll get into that in the next episode, so stick around for that.

Ethan Cook: Look forward to seeing you then.

Maria Varmazis: And that's "T-minus Space-Cyber Briefing" brought to you by N2K CyberWire. If you like what you heard today, you will also enjoy our newsletter, Signals & Space. There was a lot of research that goes into talking about something as complex as GPS. It has a fascinating history, and we just could not fit all of it into this episode. But we made sure to include more historical context on GPS in our newsletter, so you can dive even deeper and understand how this crucial system came to be what we know and love and rely on today. Our companion newsletter, Signals and Space, has the research and notes pulled together by our producer Ethan Cook and me, along with this week's top space-cyber news stories. So make sure to subscribe by visiting thecyberwire.com/newsletters. That's newsletters with an S. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space@n2k.com. We're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K helps cybersecurity professionals grow, learn, and stay informed. As the nexus for discovery and connection, we bring you the people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com. Thanks again for listening to "T-Minus." I am your host, Maria Varmazis. The show is produced by Ethan Cook and Liz Stokes. We're mixed by Elliott Peltzman and Tré Hester with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben, with content strategy by Ma'ayan Plaut. Peter Kilpe is our publisher. See you next week.