Maritime GNSS Threats and Resilience: A Layered Review of Vulnerabilities and Defences

Abstract

Global Navigation Satellite Systems (GNSS) underpin maritime Positioning, Navigation, and Timing (PNT), supporting bridge functions such as the Automatic Identification System (AIS), the Electronic Chart Display and Information System (ECDIS), radar overlays, and track-control systems. This dependence exposes vessels to non-malicious degradation, unintentional interference, jamming, spoofing, and replay-based (meaconing-type) deception. Using a structured scoping review with narrative synthesis, this paper synthesises evidence on maritime GNSS threats and resilience across the receiver-to-bridge chain. The review develops a maritime-oriented taxonomy and maps disruption across the radio-frequency (RF) front-end, acquisition and tracking, navigation-estimation, and integrated-bridge layers. It examines suppression-oriented resilience, including front-end mitigation, spatial anti-jamming, and multi-sensor fusion, alongside deception-oriented detection, integrity monitoring, and authentication, including correlator-domain monitoring, navigation-engine integrity monitoring, Galileo Open Service Navigation Message Authentication (OSNMA), and bridge-level cross-checks. The analytical novelty lies in integrating disruption mechanism, security objective, evidence type, layer of action, and residual protection gap within a maritime cross-layer decision framework spanning the receiver-to-bridge chain. This framework enables resilience measures to be interpreted and compared according to what they protect and what remains unprotected, supporting complementary rather than interchangeable defences. The synthesis shows that maritime GNSS resilience extends beyond the RF receiver to navigation-solution trust and integrated-bridge safety.

I. Introduction

GNSS now provides the common Positioning, Navigation, and Timing reference for most shipboard navigation functions. In integrated bridge operations, this reference supports AIS, ECDIS, radar overlays, and autopilot or track-control functions [1–3]. This dependence is also reflected in the wider maritime regulatory and guidance context, including International Maritime Organization (IMO) and International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) guidance and IEC 61108 receiver-equipment standards [4–6]. Yet the same concentration creates a practical vulnerability: when GNSS is degraded or manipulated, the effect may not remain local to one receiver but can propagate through several bridge subsystems and weaken the integrity of the common operational picture [2,3,7,8].

This vulnerability is partly physical: civil GNSS signals arrive at shipborne antennas at very low received power (around −130 dBm), below the in-band thermal-noise power before correlation, leaving them exposed to non-malicious interference and deliberate manipulation [2,9–11]. The legacy open, historically unauthenticated civil-signal model adds a second weakness, as its structures can be imitated with low-cost software-defined radio (SDR) toolchains, lowering the technical bar for adversaries able to generate or replay GNSS-like signals [12–15]. Operational material from 2010–2025 shows that GNSS disruption is no longer a merely theoretical receiver-security problem: the May 2025 grounding of MSC Antonia near Jeddah was associated with alleged spoofing anomalies, the December 2024 grounding of Meghna Princess near Ust-Luga with GPS jamming, sustained interference was documented in the Gulf of Finland (238 reports in 2024 and 231 in 2025), wide-area electronic disruption in the Strait of Hormuz in June 2025 coincided with a tanker collision, and C4ADS identified some 9,883 suspected spoofing instances affecting 1,311 civilian navigation systems since 2016 [16–25,29].

The operational record points to a central maritime problem: vessels must not only detect GNSS disruption but continue to operate safely when PNT becomes degraded, unavailable, or untrusted. Here, hazardously misleading information (HMI) denotes plausible-looking but unalarmed PNT outputs that may support unsafe navigational decisions, and such errors can propagate from the receiver into downstream bridge systems [9,30]. Human-factor evidence further shows that abrupt GNSS denial can trigger multi-alarm cascades and raise workload, even disabling critical displays such as ECDIS during severe disruption in documented trials [7]. The review covers shipborne GNSS disruption — suppression (primarily jamming) and deception (generative spoofing and meaconing-type replay) — treating AIS integrity degradation as a downstream consequence of GNSS compromise rather than a standalone threat category. Its four contributions are: a maritime threat taxonomy, a receiver-to-bridge model linking layers to consequences, separation of suppression-oriented resilience from deception-oriented detection, integrity, and authentication, and synthesis of the evidence into indicative countermeasure stacks for representative operational profiles [Sections 2–6].

II. Review Methodology and Analytical Framework

The study was designed as a structured scoping review with narrative synthesis, because the retained corpus spans peer-reviewed technical studies, shipborne maritime field trials, operational advisories, regulatory and standards documents, monitoring material, and incident-reporting sources [31]. Literature identification was iterative and Scopus-centred, complemented by targeted searches in IEEE Xplore, the Institute of Navigation (ION) Digital Library, MDPI, Elsevier, Springer, Cambridge University Press, and selected official institutional repositories, with backward and forward citation chasing. The principal search window covered 2010 to March 2026, followed by a targeted update in July 2026, retaining earlier seminal works of direct relevance. Screening proceeded first at title/abstract level and then through closer source or full-text assessment against the eligibility criteria (Table 1), with repeated records consolidated, borderline cases discussed jointly, and disagreements resolved conservatively in favour of the more direct, technically attributable, and maritime-relevant source. To provide a reproducible coverage check during revision, a structured Scopus coverage-verification audit was executed on 2 September 2026 across eleven formal search strands (Table S1). A stated methodological limitation is the absence of independent duplicate assessment of every record by two authors.

The synthesis was guided by four questions: (RQ1) which forms of degradation, interference, jamming, and spoofing are most relevant to maritime GNSS and how do their effects propagate across the receiver-to-bridge chain? (RQ2) which suppression-oriented resilience measures and deception-oriented detection, integrity-monitoring, and authentication techniques are reported, and at which layer do they operate? (RQ3) what evidence supports these families under maritime or maritime-relevant conditions, and what limitations, confounders, and deployment constraints apply? (RQ4) how can the evidence be synthesised into a layered maritime resilience framework, and what research and validation gaps remain? Evidence was weighted by source type, technical specificity, peer-review status, and proximity to maritime operation: experimental and technical studies for mechanism-level and performance claims, advisories, incidents, and monitoring sources for operational relevance, safety impact, and regulatory context. PRISMA-ScR [32] was consulted as a reporting reference only, not a claim of full compliance, with the retained-corpus evidence matrix in Table S2. The analytical novelty lies in integrating disruption mechanism, security objective, evidence type, layer of action, and residual protection gap within a cross-layer decision framework spanning the receiver-to-bridge chain.

III. Taxonomy of Maritime GNSS Disruption and Layer Model

The taxonomy begins by separating non-malicious degradation or unintentional interference from malicious threats — similar symptoms (loss of lock, degraded measurements, unstable tracking, misleading bridge information) can arise from atmospheric propagation, interference, or deliberate attack, but their causes and appropriate interpretation differ. Non-malicious maritime causes include sea-surface multipath, coastal refraction, ionospheric scintillation, residual tropospheric-delay errors, adjacent- or out-of-band emissions, electromagnetic-compatibility (EMC) problems, and accidental self-interference from shipborne equipment [49–54]. Reported practical examples include DME/TACAN coexistence problems in the L5/E5 region, amateur-radio overlap affecting GLONASS L2, and flawed active maritime television antennas that unintentionally behaved as GPS jammers [53]. The non-malicious/malicious distinction therefore concerns cause rather than consequence, since either category can propagate into shipboard navigation functions [8,37].

Within malicious disruption two principal mechanism families are distinguished: jamming (suppression-oriented) — RF mechanisms that raise harmful energy at the receiver input and prevent acquisition and tracking, primarily threatening availability [2,7,48]; and spoofing (deception-oriented) — mechanisms inducing an incorrect but operationally plausible navigation solution via counterfeit signals, replayed authentic signals, or manipulated observables, primarily threatening integrity and authenticity [14,15,55]. Spoofing divides into generative (attacker-synthesised counterfeits) and replay-based attacks treated here as meaconing-type behaviour: authentic signal structure is preserved but altered time of arrival biases pseudorange and the computed PVT solution [56,57]. From a security-property perspective, disruption is interpreted by the dominantly compromised property: availability (continuous acquisition and tracking), integrity (solution correctness within bounds, with hazardous errors not left undetected), and authenticity (assurance of legitimate signal origin). These properties interact: availability loss can propagate into downstream integrity problems, deception can preserve apparent continuity despite a corrupted solution, and disturbed tracking or re-acquisition can create conditions favourable to later spoofing capture [8,30,55,56].

Disruption is also traced across four layers: (1) the RF front-end — where strong interference may saturate the low-noise amplifier (LNA) or analogue-to-digital converter (ADC), raise the noise floor, and depress carrier-to-noise density (C/N₀), causing acquisition or tracking failure, the dominant manifestation of the Gulf of Finland interference and the Meghna Princess case [1,7,17,21,48]; (2) the acquisition, correlation, and tracking layer — where code delay and carrier phase are estimated through DLL/PLL loops, and jamming or spoofing may distort the correlation function or produce composite peaks affecting stable tracking, the layer most relevant to spoofing analysis since authentic–counterfeit interaction may leave correlator-domain signatures [14,15,55,59]; (3) the navigation-estimation layer — where pseudorange, carrier-phase, and Doppler measurements propagate through least-squares or Kalman-filter estimation into a PVT solution that may remain formally valid despite biased inputs, the level of the geographically misleading yet coherent anomaly associated with the MSC Antonia grounding [1,2,15,19,20]; and (4) the integrated-bridge layer — where AIS, ECDIS, radar overlays, and track control consume PVT outputs, so disruption spreads into misleading displays, alarm cascades, and degraded situational awareness, as described in the Strait of Hormuz environment [2,7,8,23,24,30]. GNSS-derived PNT may additionally be corrupted, replayed, or delayed after reception through NMEA- and IP-based bridge networks, a downstream manifestation motivating the software-based monitoring families of Section V [60].

IV. Suppression-Oriented Resilience and Anti-Jamming Techniques

Suppression-oriented resilience begins with receiver-level interference awareness and continuity-preserving reconfiguration: the receiver must first recognise an abnormal RF environment via C/N₀, automatic gain control (AGC) state, received-power behaviour, or spectral anomalies, then exclude or switch away from degraded measurements while enough usable signals remain [11,49,63]. In practice, C/N₀ values of 40–55 dB-Hz indicate robust tracking, values below about 40 dB-Hz become increasingly noisy, and values near 30 dB-Hz are critical for reliable PVT [11]. Direct maritime examples include: the GALANT platform monitoring GPS L1/L5 and Galileo E1/E5a in the Baltic and North Seas with the input-power deviation metric ΔP_in, reaching 13.4 dB in a strong wideband-chirp denial-of-service event [11]; a global container-ship campaign recording a frequency-sweeping RFI event detectable for over 5 h across ~60 km of track at the Suez Canal passage, followed by complete PVT loss near Jebel Ali at an interference-to-noise density (I/N₀) of about 45 dB [46]; the multi-frequency multi-constellation software receiver FGI-GSRx aboard the ferry MS Megastar (Helsinki–Tallinn), whose resilient mode improved 3D RMS error from 8.18 m to 4.13 m under lower-band jamming [65]; and a Finnish monitoring station that maintained PVT through a 12 h jamming episode with only 24 s of total loss by exploiting residual multi-band diversity [18]. But power-domain observables alone cannot attribute cause, and internal exclusion loses effectiveness when no sufficiently clean signal subset remains [2,10,48,65].

Front-end signal-processing mitigation acts before interference propagates into acquisition, tracking, and the navigation solution, targeting harmful energy with recognisable temporal or spectral structure: adaptive notch filtering for continuous-wave/narrowband interference, pulse blanking for short high-power pulses, and selective band excision or remapping when only part of a shared band is contaminated [53,66–68]. The clearest field evidence comes from the AIM+ package in professional Septentrio receivers: adaptive notch filtering restored C/N₀ in a GLONASS L2 band polluted by an amateur-radio digipeater at Hilversum, restored centimetre-level RTK near Tyumen, ~3% pulse blanking handled DME pulses (3.5 µs width, ~2,700 pulse-pairs/s) near Brussels Airport without major operational penalty, and GLONASS L2 band remapping sacrificed constellation diversity to recover dual-frequency GPS-only RTK at Ostend [53]. Newer literature extends the same logic to chirp interference: sub-band automatic gain control raised PVT availability from 56.3% to 90.3% and cut the 95% horizontal error radius from 4.64 m to 1.75 m under fast chirp, while an HDDM implementation held ~42 dB-Hz C/N₀ at J/S of ~60 dB in pulsed cases [66–68]. Spatial anti-jamming with antenna arrays and adaptive suppression (beamforming/nulling) preserves availability by suppressing interference directions but demands stable calibration and faces ship-motion and superstructure-scattering constraints [46,47,84].

When GNSS is severely degraded or lost, continuity-oriented fusion and holdover sustains bounded navigation by fusing GNSS with an inertial measurement unit (IMU), Doppler velocity log (DVL), and aided dead reckoning: a tightly coupled unscented Kalman filter achieved 95% horizontal position error of 10.1 m and a maximum of 23.3 m during an at-sea personal-privacy-device jamming trial in the Baltic Sea [1], though drift grows with outage duration and depends on IMU/DVL quality, initialisation, and estimator tuning. Complementary terrestrial backup layers such as R-Mode and enhanced Loran — lessons of the early-2010s Korean jamming episodes — remain infrastructure-dependent, regionally bounded, and propagation-sensitive [27,28]. The comparative synthesis (Table 4) concludes that suppression families preserve continuity under partial denial while sufficient signal diversity remains, but by nature cannot suppress overwhelming interference nor settle integrity/authenticity questions under deception-oriented threats — they preserve availability without establishing authenticity.

V. Deception Detection, Integrity Monitoring, and Authentication Layers

These layers address the deception-oriented integrity question: can the receiver, bridge system, or watch team recognise when apparently usable GNSS-derived PNT has become untrusted — i.e. hazardously misleading information is present rather than a detectable outage [9,10,12]? Correlator-domain Signal Quality Monitoring (SQM) checks whether the code-correlation peak still resembles an authentic signal, using Early/Prompt/Late outputs and Delta, Ratio, and Early–Late Phase metrics; recent multicorrelator evidence reports detection probability P_d ≈ 94.31% at false-alarm probability P_fa ≈ 0.01% on TEXBAT data, with combination logic (notably ELP–Ratio) outperforming single metrics and moving-variance processing improving detection from ~0.8 to ~0.9 [14,59,79,80]. A shipborne example off classical SQM combined multipath monitoring with moving-baseline analysis aboard the training ship Shioji-maru in Tokyo Bay [81]. But correlator distortion is not a unique spoofing signature: benign low-elevation sea-surface reflections — observed from the research vessel Shiyan 3 in the South China Sea — produce peak-like behaviour that must be modelled and removed, and replay-based (meaconing-type) retransmission is hard to identify uniquely since delayed authentic replicas resemble secondary multipath-like peaks [10,12,82]. SQM is therefore best treated as an early correlator-domain screening layer rather than standalone proof of deception, most informative during interaction and gradual takeover.

The spatial-source-discrimination family exploits the fact that authentic signals arrive from multiple sky directions consistent with satellite geometry, whereas single-source deception may carry an anomalous common-source spatial signature: in a two-vessel Baltic campaign near Hiddensee, a repeater attack was detected through spatial inconsistency at a dataset-specific threshold of ε = 0.985 with smoothing windows, while the victim position was displaced toward the repeater vessel during the successful attack [47], with shipborne feasibility supported by a seven-element conformal array with live calibration aboard a large container ship [46,84]. Navigation-engine integrity monitoring (RAIM/FDE) operates at the estimation layer with predict–compare–test–exclude–continue logic: ARAIM subset-testing exclusion cut maximum horizontal error from nearly 450 m to about 16 m in the TEXBAT ds5 case (while failing to improve the ds6 solution), Clustering-RAIM held corrections to ~15–19 m at 99% confidence for two-to-three manipulated satellites given at least six satellites in view [85,86], and the Time Jumper approach showed bounded continuation via a Doppler-only Kalman filter [15]. This family depends on redundancy and geometry, so clean overpowering capture or physically coherent spoofing that leaves no inconsistent subset to exclude can bypass it [85].

Galileo OSNMA provides a navigation-message authenticity layer — protection against data forgery — with experimental studies reporting authenticated fixes 99.996% of the time in open sky and receiver-policy alarms under inconsistent or replicated OSNMA material in maritime ASGARD testing [91,99]; but it authenticates data, not the physical ranging path, so replay-based or synchronised spoofing may still bias PVT, and strict authentication policies can reduce continuity under masking — complementary rather than standalone anti-spoofing protection. System- and network-level PNT integrity monitoring offers a low-cost retrofit layer for legacy bridges: spoofing-induced clock-bias jumps from about 0.04 µs to 1.63 ms have been reported with alarm latency below 2 s in receiver clock-state verification [104,105]. Finally, bridge-level cross-checks rely on genuinely source-diverse physical corroboration — raw or relative radar geometry, visual observations, depth cues — with radar/ENC positioning in the Gulf of Gdańsk achieving better than 6.5 m RMS in simulation and 34.1 m RMS on real data [110]; agreement among several GNSS-fed bridge products is consistency, not independent verification, and human factors remain decisive [7,30].

VI. Conclusions and Future Directions

This review treats maritime GNSS disruption as a shipborne PNT resilience problem extending from the receiver to the integrated bridge: jamming, interference, spoofing, and replay-based deception can degrade or falsify GNSS-derived position, velocity, and time, thereby affecting situational awareness, route monitoring, AIS/ECDIS information, and ultimately navigation safety. The main conclusion is that no single countermeasure family is sufficient: suppression-oriented measures preserve continuity under denial but do not establish authenticity, while deception-oriented measures provide integrity or authenticity evidence bounded by attacker assumptions, maritime confounders, data access, and deployment conditions. Resilience therefore depends on complementary measures selected by disrupted property, affected layer, and residual protection gap; OSNMA is treated as complementary message-authenticity evidence; and agreement among several GNSS-fed bridge products does not constitute independent verification. Table 6 translates the reviewed families into evidence-informed, indicative countermeasure stacks for representative profiles: the basic vessel (multi-GNSS use, interference awareness, radar/visual cross-checks, fallback procedures), the high-risk vessel (plus OSNMA-capable processing, inertial/log/DVL aiding, stricter alarm interpretation), the port authority/VTS (coastal monitoring, AIS/GNSS anomaly correlation, escalation links), and the coastal monitoring station (multi-constellation RF monitoring, time-synchronised logging, localisation).

Several priorities follow: further shipborne validation of advanced detection under realistic maritime conditions (vessel motion, superstructure multipath, sea-surface reflections, legacy receiver constraints); study of authentication-aware receiver policies balancing authenticated-only processing against continuity, multi-constellation fusion, and bridge usability; and development of system- and network-level PNT integrity monitoring as a practical retrofit layer where RF, correlator, or array observables are unavailable. A relevant near-term development is the Galileo Signal Authentication Service (SAS), which — if validated shipborne — could be especially relevant for replay-based (meaconing-type) deception where message authentication alone is insufficient, with GPS Chimera as a comparative reference [102,103,111]. Maritime resilience would further benefit from harmonised interference reporting, shared situational awareness, clearer bridge procedures for degraded or untrusted PNT, and AI/ML methods for interference characterisation and anomaly detection — subject to stronger validation, explainability, and integration with conventional integrity logic. Overall, maritime GNSS resilience should be treated as cross-layer bridge resilience, with complementary measures selected for distinct availability, integrity, and authenticity roles rather than reliance on any single detector or authentication mechanism.