Todd Humphreys How to fool a GPS

Translator: Joseph Geni
Reviewer: Morton Bast

Something happened in the early morning hours

of May 2nd, 2000, that had a profound effect

on the way our society operates.

Ironically, hardly anyone noticed at the time.

The change was silent, imperceptible,

unless you knew exactly what to look for.

On that morning, U.S. President Bill Clinton

ordered that a special switch be thrown

in the orbiting satellites of the Global Positioning System.

Instantaneously, every civilian GPS receiver

around the globe went from errors the size of a football field

to errors the size of a small room.

It’s hard to overstate the effect that this change

in accuracy has had on us.

Before this switch was thrown, we didn’t have

in-car navigation systems giving turn-by-turn

directions, because back then, GPS couldn’t tell you

what block you were on, let alone what street.

For geolocation, accuracy matters,

and things have only improved over the last 10 years.

With more base stations, more ground stations,

better receivers and better algorithms,

GPS can now not only tell you what street you are on,

but what part of the street.

This level of accuracy

has unleashed a firestorm of innovation.

In fact, many of you navigated here today

with the help of your TomTom or your smartphone.

Paper maps are becoming obsolete.

But we now stand on the verge of another revolution

in geolocation accuracy.

What if I told you that the two-meter positioning

that our current cell phones and our TomToms give us

is pathetic compared to what we could be getting?

For some time now, it’s been known that if you pay attention

to the carrier phase of the GPS signal,

and if you have an Internet connection,

then you can go from meter level to centimeter level,

even millimeter-level positioning.

So why don’t we have this capability on our phones?

Only, I believe, for a lack of imagination.

Manufacturers haven’t built this carrier phase technique

into their cheap GPS chips

because they’re not sure what the general public would do

with geolocation so accurate that you could pinpoint

the wrinkles in the palm of your hand.

But you and I and other innovators,

we can see the potential in this next leap in accuracy.

Imagine, for example, an augmented reality app

that overlays a virtual world to millimeter-level precision

on top of the physical world.

I could build for you a structure up here in 3D,

millimeter accurate, that only you could see,

or my friends at home.

So this level of positioning, this is what we’re looking for,

and I believe that, within the next few years, I predict,

that this kind of hyper-precise, carrier phase-based positioning

will become cheap and ubiquitous,

and the consequences will be fantastic.

The Holy Grail, of course, is the GPS dot.

Do you remember the movie “The Da Vinci Code?”

Here’s Professor Langdon examining a GPS dot,

which his accomplice tells him is a tracking device

accurate within two feet anywhere on the globe,

but we know that in the world of nonfiction,

the GPS dot is impossible, right?

For one thing, GPS doesn’t work indoors,

and for another, they don’t make devices quite this small,

especially when those devices have to relay

their measurements back over a network.

Well, these objections were perfectly reasonable

a few years ago, but things have changed.

There’s been a strong trend toward miniaturization,

better sensitivity, so much so that, a few years ago,

a GPS tracking device looked like this clunky box

to the left of the keys.

Compare that with the device released just months ago

that’s now packaged into something the size of a key fob,

and if you take a look at the state of the art

for a complete GPS receiver, which is only a centimeter

on a side and more sensitive than ever,

you realize that the GPS dot will soon move

from fiction to nonfiction.

Imagine what we could do with a world full of GPS dots.

It’s not just that you’ll never lose your wallet or your keys

anymore, or your child when you’re at Disneyland.

You’ll buy GPS dots in bulk, and you’ll stick them on

everything you own worth more than a few tens of dollars.

I couldn’t find my shoes one recent morning,

and, as usual, had to ask my wife if she had seen them.

But I shouldn’t have to bother my wife with that kind of triviality.

I should be able to ask my house where my shoes are.

(Laughter)

Those of you who have made the switch to Gmail,

remember how refreshing it was to go from

organizing all of your email to simply searching it.

The GPS dot will do the same for our possessions.

Now, of course, there is a flip side to the GPS dot.

I was in my office some months back

and got a telephone call.

The woman on the other end of the line, we’ll call her Carol,

was panicked.

Apparently, an ex-boyfriend of Carol’s from California

had found her in Texas and was following her around.

So you might ask at this point why she’s calling you.

Well, so did I.

But it turned out there was a technical twist to Carol’s case.

Every time her ex-boyfriend would show up,

at the most improbable times and the most improbable locations,

he was carrying an open laptop,

and over time Carol realized that he had planted

a GPS tracking device on her car,

so she was calling me for help to disable it.

“Well, you should go to a good mechanic

and have him look at your car,” I said.

“I already have,” she told me.

“He didn’t see anything obvious,

and he said he’d have to take the car apart piece by piece.”

“Well then, you’d better go to the police,” I said.

“I already have,” she replied.

“They’re not sure this rises to the level of harassment,

and they’re not set up technically to find the device.”

“Okay, what about the FBI?”

“I’ve talked to them too, and same story.”

We then talked about her coming to my lab

and us performing a radio sweep of her car,

but I wasn’t even sure that would work,

given that some of these devices are configured

to only transmit when they’re inside safe zones

or when the car is moving.

So, there we were.

Carol isn’t the first, and certainly won’t be the last,

to find herself in this kind of fearsome environment,

worrisome situation caused by GPS tracking.

In fact, as I looked into her case,

I discovered to my surprise that it’s not clearly illegal

for you or me to put a tracking device on someone else’s car.

The Supreme Court ruled last month that a policeman

has to get a warrant if he wants to do prolonged tracking,

but the law isn’t clear about civilians doing this to one another,

so it’s not just Big Brother we have to worry about,

but Big Neighbor. (Laughter)

There is one alternative that Carol could have taken,

very effective. It’s called the Wave Bubble.

It’s an open-source GPS jammer,

developed by Limor Fried,

a graduate student at MIT, and Limor calls it

“a tool for reclaiming our personal space.”

With a flip of the switch you create a bubble around you

within which GPS signals can’t reside.

They get drowned out by the bubble.

And Limor designed this, in part, because, like Carol,

she felt threatened by GPS tracking.

Then she posted her design to the web,

and if you don’t have time to build your own,

you can buy one.

Chinese manufacturers now sell thousands

of nearly identical devices on the Internet.

So you might be thinking, the Wave Bubble sounds great.

I should have one. Might come in handy if somebody ever puts a tracking device on my car.

But you should be aware that its use is very much illegal

in the United States.

And why is that?

Well, because it’s not a bubble at all.

Its jamming signals don’t stop at the edge

of your personal space or at the edge of your car.

They go on to jam innocent GPS receivers for miles around you. (Laughter)

Now, if you’re Carol or Limor,

or someone who feels threatened by GPS tracking,

it might not feel wrong to turn on a Wave Bubble,

but in fact, the results can be disastrous.

Imagine, for example, you’re the captain of a cruise ship

trying to make your way through a thick fog

and some passenger in the back turns on a Wave Bubble.

All of a sudden your GPS readout goes blank,

and now it’s just you and the fog

and whatever you can pull off the radar system

if you remember how to work it.

They – in fact, they don’t update or upkeep lighthouses

anymore, and LORAN, the only backup to GPS,

was discontinued last year.

Our modern society has a special relationship with GPS.

We’re almost blindly reliant on it.

It’s built deeply into our systems and infrastructure.

Some call it “the invisible utility.”

So, turning on a Wave Bubble might not just cause inconvenience.

It might be deadly.

But as it turns out, for purposes of protecting your privacy

at the expense of general GPS reliability,

there’s something even more potent

and more subversive than a Wave Bubble,

and that is a GPS spoofer.

The idea behind the GPS spoofer is simple.

Instead of jamming the GPS signals, you fake them.

You imitate them, and if you do it right, the device

you’re attacking doesn’t even know it’s being spoofed.

So let me show you how this works.

In any GPS receiver, there’s a peak inside

that corresponds to the authentic signals.

These three red dots represent the tracking points

that try to keep themselves centered on that peak.

But if you send in a fake GPS signal,

another peak pops up, and if you can get these two peaks

perfectly aligned, the tracking points can’t tell the difference,

and they get hijacked by the stronger counterfeit signal,

with the authentic peak getting forced off.

At this point, the game is over.

The fake signals now completely control this GPS receiver.

So is this really possible?

Can someone really manipulate

the timing and positioning of a GPS receiver

just like that, with a spoofer?

Well, the short answer is yes.

The key is that civil GPS signals

are completely open.

They have no encryption. They have no authentication.

They’re wide open, vulnerable to a kind of spoofing attack.

Even so, up until very recently,

nobody worried about GPS spoofers.

People figured that it would be too complex

or too expensive for some hacker to build one.

But I, and a friend of mine from graduate school,

we didn’t see it that way.

We knew it wasn’t going to be so hard,

and we wanted to be the first to build one

so we could get out in front of the problem

and help protect against GPS spoofing.

I remember vividly the week it all came together.

We built it at my home, which means that

I got a little extra help from my three-year-old son Ramon.

Here’s Ramon — (Laughter) —

looking for a little attention from Dad that week.

At first, the spoofer was just a jumble of cables

and computers, though we eventually got it packaged

into a small box.

Now, the Dr. Frankenstein moment,

when the spoofer finally came alive

and I glimpsed its awful potential,

came late one night when I tested the spoofer

against my iPhone.

Let me show you some actual footage from that

very first experiment.

I had come to completely trust this little blue dot

and its reassuring blue halo.

They seemed to speak to me.

They’d say, “Here you are. Here you are.” (Laughter)

And “you can trust us.”

So something felt very wrong about the world.

It was a sense, almost, of betrayal,

when this little blue dot started at my house,

and went running off toward the north

leaving me behind. I wasn’t moving.

What I then saw in this little moving blue dot

was the potential for chaos.

I saw airplanes and ships veering off course, with the captain

learning only too late that something was wrong.

I saw the GPS-derived timing

of the New York Stock Exchange

being manipulated by hackers.

You can scarcely imagine the kind of havoc

you could cause if you knew what you were doing

with a GPS spoofer.

There is, though, one redeeming feature

of the GPS spoofer.

It’s the ultimate weapon against an invasion of GPS dots.

Imagine, for example, you’re being tracked.

Well, you can play the tracker for a fool,

pretending to be at work when you’re really on vacation.

Or, if you’re Carol, you could lure your ex-boyfriend

into some empty parking lot

where the police are waiting for him.

So I’m fascinated by this conflict, a looming conflict,

between privacy on the one hand

and the need for a clean radio spectrum on the other.

We simply cannot tolerate GPS jammers and spoofers,

and yet, given the lack of effective legal means

for protecting our privacy from the GPS dot,

can you really blame people for wanting to turn them on,

for wanting to use them?

I hold out hope that we’ll be able to reconcile

this conflict with some sort of,

some yet uninvented technology.

But meanwhile, grab some popcorn,

because things are going to get interesting.

Within the next few years,

many of you will be the proud owner of a GPS dot.

Maybe you’ll have a whole bag full of them.

You’ll never lose track of your things again.

The GPS dot will fundamentally reorder your life.

But will you be able to resist the temptation

to track your fellow man?

Or will you be able to resist the temptation

to turn on a GPS spoofer or a Wave Bubble

to protect your own privacy?

So, as usual, what we see just beyond the horizon

is full of promise and peril.

It’ll be fascinating to see how this all turns out.

Thanks. (Applause)