In January 2016, the US Air Force decommissioned a single GPS satellite (SVN 23) and accidentally uploaded a 13.7-microsecond timing error into the broadcast navigation data. That 0.000013-second offset knocked BBC digital radio transmitters off the air for two days and broke police and fire dispatch networks across North America.
Today, an attacker with a software-defined radio can force that exact timing failure on a target building from across the street.
1. Why critical infrastructure relies on a 1970s radio signal
Cell towers, power substations, and stock exchanges all need their servers to tick in lockstep. Installing a commercial cesium atomic clock at every site costs roughly $65,000 per unit, so operators bolt a $200 GPS timing receiver to the roof instead.
That rooftop antenna listens to atomic clocks aboard 31 GPS satellites orbiting 20,200 kilometers above the Earth.
Civilian GPS L1 C/A was designed in the 1970s with no cryptographic authentication. Worse, by the time a satellite's radio signal travels 20,200 kilometers through space, it hits the Earth's surface at roughly -130 dBm (a tenth of a femtowatt). A 10-milliwatt transmitter plugged into a laptop in a parking lot is tens of millions of times stronger at the rooftop antenna than the real satellites in orbit.
2. Jam-and-spoof vs. synchronous time-walking
If an attacker uses an open-source tool like gps-sdr-sim on a $300 SDR to broadcast a fake timestamp that is an hour off, a modern timing receiver spots the sudden jump and switches to its internal backup oscillator.
To bypass that check, attackers use clock slewing, also known as time walking:
* Hard takeover (gps-sdr-sim): A basic attacker generates a pre-computed baseband file that starts at the current UTC second, transmits strongly enough to force the rooftop receiver to lose lock on the real sky and re-acquire the louder fake signal, and then plays back a programmed clock drift.
* Seamless carry-off (Synchronous spoofer): Against hardened receivers that alert on any signal drop, a more advanced spoofer uses a receiving antenna to track the live satellites in real time. It transmits a counterfeit signal matched to the exact code phase and Doppler shift of the real sky at the victim's antenna, ramps up its power by a few decibels to capture the receiver's Delay-Locked Loop (DLL), and pulls the timing pulse forward by 100 to 200 nanoseconds per second.
Because the drift stays inside the receiver's tracking threshold, the local clock slides smoothly away from UTC without raising a loss-of-lock alarm.
3. What breaks when a clock drifts by microseconds
Once a site's local clock drifts past a few microseconds, automated protection hardware starts shutting equipment down:
* 5G TDD cell tower mute (±1.5 microseconds): Most mid-band 5G networks use Time Division Duplexing (TDD), where towers transmit and receive on the exact same frequency by alternating time slots every few milliseconds. The 3GPP specification requires neighboring towers to stay synchronized within ±1.5 microseconds (a 3-microsecond maximum window between adjacent base stations). If a spoofed tower drifts past 1.5 microseconds, its 100-watt downlink burst transmits directly into the neighboring tower's uplink listening window, deafening the cell. To prevent cross-link interference, the baseband's synchronization watchdog automatically mutes the radio transmitter and drops every phone on the tower.
* 500 kV substation breaker trips (100 microseconds): High-voltage transmission lines use Line Current Differential Relays (ANSI 87L) at both ends of a wire to compare AC phase angles using GPS timestamps, while Phasor Measurement Units (PMUs) track grid stability across cities. Under IEEE C37.118, just 26.5 microseconds of timing error creates a 1% Total Vector Error on a 60 Hz line (31.8 microseconds on a 50 Hz grid). If an attacker walks one substation's GPS clock off by 100 to 200 microseconds, the differential relay sees a massive phantom phase shift between the two ends of the transmission line, assumes the cable has suffered a short circuit, and trips the main 500 kV breakers on a healthy power line.
* High-frequency trading halts (100 microseconds): Under European MiFID II RTS 25 rules, automated trading engines must timestamp every order within 100 microseconds of UTC. When the exchange's time-sync daemon detects that its GPS discipline has breached that 100-microsecond ceiling, compliance middleware halts order execution.
4. How infrastructure operators defend the clock
Upgrading an orbiting satellite constellation takes decades, so engineers harden the ground equipment across four layers:
* Galileo OSNMA and Chimera: Europe's Galileo constellation now broadcasts OSNMA (Open Service Navigation Message Authentication), which cryptographically signs the navigation data bits so a tool like gps-sdr-sim cannot forge satellite messages. Because an attacker can still record and delay genuine signed signals (a meaconing relay attack), newer systems pair data signatures with encrypted spreading-code markers like Galileo CAS and GPS Chimera.
* Multi-constellation and multi-band receivers: Timing receivers track GPS, Galileo, BeiDou, and GLONASS across both L1 and L5 bands simultaneously. Spoofing four constellations across multiple frequencies at once requires vastly more complex RF hardware.
* Anti-spoofing CRPA antennas: Critical sites use Controlled Reception Pattern Antennas (multi-element phased arrays) or choke-ring antennas that only accept signals arriving from high up in the sky and null out radio signals coming horizontally from a parking lot.
* PTP over fiber and rubidium holdover: Telecom and grid operators back up rooftop antennas with Precision Time Protocol (IEEE 1588v2) distributed over fiber-optic lines, paired with local Oven-Controlled Crystal Oscillators (OCXOs) or miniature rubidium atomic clocks. If the rooftop antenna drifts faster than the internal rubidium physics package allows, the timing card disconnects the GPS input and free-runs within 1 microsecond for up to 72 hours.
