Satellite-navigation spoofing in civil aviation

Six statements about the model; the mapping to aviation is a reconstruction R, and no statement is an estimate of any real receiver's risk.

• Spoofing writes the receiver's evidence. A receiver whose only evidence is the fix is Model M4's defender: the spoofer authors the claim, and no fixed policy of belief or disbelief is safe against a spoofer who knows it (Proposition 5.10 (p. 216)). Every protection the record describes (consistency symptoms, conventional aids, time comparison, controllers' monitoring) adds evidence the spoofer does not write. That is the step from Model M4 to Model M6 R.

• Each layer of checking moves the spoofer, and raises the guarantee. Against a receiver that trusts the fix the spoofer's best reply is the jump; against one that reverts on implausible fixes it is the glide, because $e>1-r$; against one that also cross-checks it is the jump again, because the cross-check cancels the glide's advantage and its false alarms are paid in every clean encounter. The receiver's guaranteed result rises from $\frac{1}{2}$ to $\frac{5}{8}$ to $\frac{29}{40}$ (Table 5.1 (p. 205)). The deceiver's reply alternates with the receiver's depth, as in Model M4; the receiver's result, unlike in Model M4, does not depend on parity D [Proposition 5.14 (p. 219)(a)].

• A fixed rule for disagreements is exploitable. With the independent cross-check the receiver's guaranteed result is $\frac{19}{26}$, above every pure policy: it reverts on a disagreement with probability $\frac{10}{13}$, and the spoofer jumps with probability $\frac{11}{13}$. Reverting on every disagreement guarantees only $\frac{29}{40}$. The randomisation stands for unpredictability from the spoofer's point of view — across aircraft types, procedures and crews — not for a crew tossing a coin; the model does not say which institutional form achieves it D [Proposition 5.14 (p. 219)(b); the reading is R].

• A cross-check pays only where spoofing is common enough to change the decision. The independent cross-check adds nothing for $s\le \frac{2}{15}$ and something for every $s$ strictly between $\frac{2}{15}$ and $1$ (Figure 5.5 (p. 206)). Below the threshold a disagreement is more likely a false alarm than a spoof, and acting on it costs more than it saves; this is Chapter 1's value of information, by which a signal is worth something only if it can change the decision (Proposition 1.2 (p. 55)), evaluated against the glide, the spoof the cross-check exists to catch. Parts of the bulletin's guidance apply to flights into or near the affected areas D [European Union Aviation Safety Agency 2026]; the model gives that practice a structural reason: the same procedure can be pure cost on one route and worth a great deal on another D [Proposition 5.14 (p. 219)(c); the reading is R].

• Independence is the asset. A cross-check that echoes the fix with probability $\frac{1}{2}$ (a stylised coupling, motivated by the bulletin's listed symptom of a deviating hybrid inertial/GNSS position) is a garbling of the independent one. By Blackwell's theorem, applied to the receiver's problem against each mixture of the spoofer, it is worth no more at any $s$: at $s=\frac{1}{2}$ it guarantees $\frac{111}{160}$ against $\frac{19}{26}$. It has the same lower threshold, $\frac{2}{15}$, because the coupling scales its detection and its false alarms alike; and it is worthless from $s=\frac{38}{45}$, where the independent check still adds $\frac{14}{195}$. Once spoofing is common enough, only a check the spoofer cannot drag along with the fix still adds anything — though even that advantage shrinks to nothing as spoofing becomes certain D [Proposition 5.14 (p. 219)(b), (c)].

• The fallback sets the floor. Without a cross-check the receiver's guaranteed result is $\max (1-se,r)$, and when spoofing is certain ($s=1$) no check adds anything: what remains is the value of reverting, $r$. Maintaining conventional navigation aids, as the 2024 measures and the 2025 joint statement ask, does two separate things in the model: it keeps an independent experiment available (items iv and v), and it keeps the floor $r$ from falling D [Proposition 5.14 (p. 219)(b), (c); International Air Transport Association 2024; International Civil Aviation Organization 2025; the mapping is R].

The receiver is not one reasoner: a crew, several avionics systems with fixed firmware, an operator's procedures and air traffic control each hold part of the evidence, and their “depths” are engineering and training properties, not choices made in the encounter. The spoofer of the model is a worst case, not a description: counterfeit signals in the record are broadcast over areas and reach many aircraft at once, most of which no transmitter is choosing against; constant-sum payoffs give the receiver a guarantee, not a forecast of anyone's behaviour. Displacement is binary in the model and continuous in fact, and its effects are not confined to one encounter: the bulletin warns that GNSS may remain unusable after the aircraft has left the area and that misleading positions may appear later, for example on approach. That is a dynamic problem, closer to Chapter 1's partially observed models than to a one-shot game. The displacement is one-dimensional in a second sense: counterfeit signals corrupt the timing the receiver computes along with its position — the bulletin's symptoms include shifts in time and date as well as spurious terrain warnings, and the FAA's list pairs aircraft clock changes with unreliable triggering of terrain-warning systems D [European Union Aviation Safety Agency 2024; Federal Aviation Administration 2024] — and since aircraft time their systems and feed their terrain-warning equipment from the same satellite signals, such a spoof attacks trust in the instruments generally, not only the one position estimate the model tracks R. Spoofed time and spurious terrain warnings create costs of their own, including the cost of responding to a false warning, which the single payoff $r$ hides. The plausibility check of the model never flags a genuine fix; real consistency monitoring has false alarms too. And many receivers share one sky: one aircraft's report is another's cross-check, which the model does not contain.