2012 U.S. Remarks from GNSS Vulnerabilities and Solutions Conference

May 22, 2012

A U.S. government representative delivered the following remarks about GPS interference issues during the 6th GNSS Vulnerabilities and Solutions Conference in Baška, Croatia.

Learn more about GPS spectrum and interference issues

Radio Frequency Interference and the Cybersecurity Framework

Robert Crane, Senior Homeland Security Advisor
National Coordination Office for Space-Based Positioning, Navigation and Timing

Good morning, it's a pleasure to be here.

The growing number of attacks on our cyber networks1 has become, in President Obama's words, "one of the most serious economic and national security challenges."2 "Cyberspace3 touches nearly every part of our daily lives: it's the broadband networks beneath us and the wireless signals around us, the local networks in our schools and hospitals and businesses, and the massive grids that power our nation."4 Today I will address United States' enforcement efforts relating to radio frequency interference and offer a new perspective for examining radio frequency interference including the GPS/GNSS signals within the existing cybersecurity framework. This timely and important discussion focuses on the recognition that cyberspace and the global communications, information and navigation infrastructure is quickly evolving toward an integrated mobile environment transporting large amounts of data and information through the radio spectrum.5

Before I begin, I would like to thank the Royal Institute of Navigation, the University of Nottingham and the Faculty of Maritime Studies at the University of Rijeka, Croatia, Dr. Filjar and Chairman McKinlay for their leadership and facilitation of this important annual forum to share perspectives, formulate opinions, offer solutions and seek consensus where possible.

As a homeland security professional, every day I wake up thinking about the opportunities and threats that lie ahead. For most people, their day is likened to looking out the windshield of an automobile and only seeing what lies immediately in front of the hood... dealing with the weather and staying alert for barriers to their daily activities. As anyone knows, it can be easy to fall into the trap of just looking at the pavement and the individual mile posts, rather than considering the landscape and the environment as a whole. There is an old proverb that applies -- "can't see the forest for the trees" -- meaning people pay too much attention to the small details and not enough to the larger issue -- the big picture of what's right before them.

Using this as the backdrop, the growing risk of interference to radio spectrum is a concern in an increasingly mobile environment. We must seek ways for protecting radio frequencies with the goal of rapidly identifying, locating, and mitigating interference sources when they occur and ensuring communications, information and navigation capabilities are secure, resilient, and rapidly restored after an incident.

Collectively, we have all been fortunate from a positioning, navigation and timing, or PNT, perspective over the last couple decades in facing relatively unsophisticated adversaries with either limited access to or limited desire to routinely employ interference or disruptive technologies.

But we know as events unfold across the globe, the intent and capabilities to disrupt networks exist.

As far as enforcement of laws and regulations against network disruptions are concerned, the United States remains committed to protecting the radio spectrum and minimizing intentional or unintentional sources of interference through spectrum regulations (both domestic and international), outreach, interference detection and mitigation efforts, and enforcement actions.

We continue to engage in outreach with our international governmental and nongovernmental partners, in recognition of our mutual interests, interdependencies and reliance on a resilient global communications, information and navigation infrastructure. Uninterrupted radio signals and protection of mission critical radio bands are vitally important for ensuring the continuity of business, government, public safety and global supply chains.

I can say with certainty, that senior leaders across the U.S. Government are aware of the potential impact of such interference; they continue to consider the risks when developing policy, doctrine and courses of action.

Led by the Federal Communications Commission (FCC), the United States is committed to strict enforcement of our federal laws and regulations prohibiting the use, marketing and sale of equipment designed to intentionally block, jam, or interfere with licensed or authorized radio communications, including navigation signals.6 Through a number of notices and enforcement actions, the United States has underscored a long-standing prohibition that applies to any type of equipment for the transmission of energy or communications or signals by radio, including devices that interfere with cellular and Personal Communications Services (PCS), Law Enforcement/1st Responder tactical radio communications, wireless networking services (Wi-Fi) and the Global Positioning System (GPS).

Jamming devices not only disrupt authorized radio services, but also jeopardize critical infrastructures and mission-critical public safety communications, such as emergency calls and notification, and could compromise first responder and law enforcement efforts. Ensuring the public's access to these vital services is critically important. A complete list of enforcement actions is available at the FCC website.

Next, examining radio frequency interference within the existing comprehensive cybersecurity framework offers an approach for near real-time and continuous monitoring, reporting, analysis, and sharing of interference information, for timely, coordinated responses to deliberate acts.

U.S. policymakers are considering the risks of interference to the radio spectrum within the context of the cyber domain. Discussions seek to understand and weigh those risks against the potential impacts to the mobile environment as governments, industries and consumers move toward an integrated mobile communications, information and navigation architecture (Satellite, Cellular, Wi-Fi, Bluetooth, GPS, others reliant on wireless, radio frequencies).

The risk is driven by two major trends: (1) the evolution of integrated mobile technologies and greater reliance on spectrum for wireless communications linking voice, video, text, Internet, position and data services, and (2) worldwide proliferation of capabilities to disrupt vital networks by various means.

So, how do we meet these challenges when traditional methods seem increasingly inadequate? There have been discussions in Washington within the last year on an alternative approach: examining the relationship between GPS interference and wireless within the existing comprehensive cybersecurity framework and related interference. Traditionally we have limited our consideration of GPS signals within the context of radio navigation frequency spectrum assignments. Instead, we need to start thinking of it more broadly as another wireless technology (one of many) and use the tools and techniques to monitor, protect and share information that we do for broadcast signals or cell phone interference.

Or going one step further, we could use tools and techniques as if a wired line were intentionally cut. This perspective links intentional and unintentional GPS signal interference – including jamming and signal imitation, or spoofing, – to the broader potentiality of radio frequency interference within the larger, integrated mobile environment that includes wireless voice, video, data, text, and Internet services.

It becomes linked to a denial-of-service attack7 against our communications, information, and navigation infrastructure.

This approach focuses on the recognition that the global communications, information and navigation infrastructure is converging and transporting large amounts of data and information through the radio spectrum. Therefore, there needs to be a realization that like copper, fiber and coax, spectrum is a vital channel of communication and commerce worthy of protection.8 And, finally, we should examine cyber security definitions and policies largely focused on the collection of "wired" systems and the Internet networks.9

Bottomline, we should try to manage interference in near real-time with continuous monitoring, reporting, and sharing of interference information and build a common operating picture that improves situational awareness and response within the broader cyber domain. Thus analysts will be able to respond more quickly to reports of interference and better determine whether someone or organization intends to do harm.

Now let's talk about Trends. It's surprising the speed by which consumers are quickly adopting wireless technologies and choosing to replace traditional communication tools with mobile devices. The U.S. Wireless Association reports nearly 332 million U.S. subscriber connections.10 From an emergency call basis, the association projects over 400,000 calls per day and that number is expected to grow. By 2015, ABI Research indicates there will be approximately 212 million wireless "smart meter" systems and "smart grid" projects.11

The enhanced capacity of transmitted data leads to further growth.

Cisco reports:12 "Global mobile data traffic will increase 18-fold by 2016... By the end of year, the number of mobile-connected devices will exceed the number of people on earth, and by 2016 there will be 1.4 mobile devices per person. There will be over 10 billion mobile-connected devices in 2016, including machine-to-machine ("M2M") connections -- exceeding the world's projected population at that time (7.3 billion)."

As wireless technologies aim to provide experiences formerly only available through wired networks, the next few years will be critical for network deployments. This evolution will create adaptable platforms upon which will be multitudes of mobile devices and applications. Even more importantly, the evolution will create additional opportunities for uses that exceed the capabilities of wired technologies and those opportunities can only be realized if the channels of communications can be protected sufficiently to ensure public confidence. At the same time, Cellular communication between objects, machines, or sensors has led to the growth of Machine-to-Machine technologies allowing both wireless and wired systems to communicate with other devices of the same ability.

Machine-to-Machine connections are in the form of "smart metering," business and consumer transactions, inventory management, fleet management, and healthcare management. As real-time information monitoring is helping companies to deploy new video-based security systems, and helping hospitals and healthcare professionals to remotely monitor the progress of their patients, bandwidth intensive M2M connections are becoming more prevalent. Traditional appliances and devices, such as home appliances, vehicles, energy meters, and vending machines -- which historically have not been connected directly to cellular networks -- are now entering those networks.

For example, GPS is an essential element in the future of Intelligent Transportation Systems (ITS), encompassing a broad range of communications-based information and electronics technologies and advanced driver assistance systems.13

The evolution brings changes in the risk profile of the communications, information and navigation infrastructure. An integrated mobile environment, coupled with major global mobile data traffic projections and growth trends, this discussion is particularly relevant in today's world of Global Navigation Satellite Systems (GNSS). GNSS, mobile communications networks, other critical infrastructures, information systems and public safety networks are heavily reliant on the radio spectrum.

As technology and the communications, information and navigation infrastructure evolve, associated policy and governance must also evolve. Governments and industry must work together to ensure that each has access to tools that allow it to communicate internally and share information among partners – including our international partners. It is also critical that as technology evolves, appropriate security, safety, regulatory and enforcement keep pace.

Accomplishing this goal requires the U.S. and its international partners to develop strategies to address challenges and risks inherent in emerging, and often gamechanging, mobile technologies. Public safety, critical infrastructure, governments and the public are increasingly relying on these emerging technologies, which require uninterrupted radio signals. Further, the global community's newfound reliance on mobile devices, social networking tools, and other critical applications, presents both opportunities and challenges.

The global communications network is a complex system of communications, information and navigation systems, which incorporates multiple technologies and services with diverse ownership. This infrastructure includes wired, wireless, satellite, cable, broadcasting capabilities, and the transport networks that support the Internet and other information systems.

Therefore, like systems wired together by copper, fiber and coax connections, radio spectrum comprises indispensable channels of communications and commerce. These channels include uplinks and downlinks from GNSS and communications satellites, ground-to-ground and now machine-to-machine transmissions.

An attack on our channels of communications is a denial-of-service attack14 on our cyberspace. Intentions and actions to deny, degrade, disrupt, or destroy information, information systems, or the services they provide, could fall within the purview of cybersecurity. We are talking about intentionally preventing information/data from traveling through the spectrum. Therefore, I would argue that jamming, "spoofing" or other forms of intentional interference to such movement in the electromagnetic spectrum should be viewed as cyber disruptions.

Cybersecurity has been a significant area of emphasis for the U.S. Government, and one of the U.S.'s priorities over the last year, countering these threats and securing the critical infrastructure and networks on which we depend. The U.S. looks forward to continuing to work with the international community to implement efforts to create a safe, secure, and resilient cyber environment, and to promote greater cybersecurity knowledge, awareness and information sharing.

Integration of diverse, independent sources of information helps serve as a deterrent to intentional disruption. As long as a hacker or terrorist thinks they will have a substantial impact, it is a desirable target. However, if the impact is reduced to more of a nuisance or not noticeable at all, they may not bother.

Arguably, it has become difficult to reach agreement on how to define cyberspace due to the complexities of the information and communications networks and the roles of government and the private sector. The nature of cyberspace and its dependency on the radio spectrum will continue to grow as time and technology progress. Aligning spectrum issues with the cyber domain will help to broaden the range and scope of our real-time monitoring, analytics and situational awareness.

In conclusion, mobile technologies are now nearly ubiquitous and automated. As we embrace, and become more reliant upon, these technologies for communications, information and navigation, we need to be talking about ALL aspects of spectrum uses – ground, air, sea and satellite – the uses and the 12 technologies available today and those planned for the future. Access to a reliable and resilient communications, information and navigation capabilities is critical to the international community for maintaining public health, safety, the global economy, global supply chains, and public confidence.

The relationship between cyberspace and spectrum will become virtually indistinguishable as time, technology and networks progress toward an integrated mobile architecture (Satellite, Cellular, Wi-Fi, Bluetooth, GPS, others).

Once we understand how technology converges, influences and affects the information/data and its flow, then we can focus on tools and methods to create desired detection and mitigation effects. We need to continue exploring this area.

Finally, the U.S. remains committed to international cooperation in identifying those who intend to disrupt or harm critical systems, and in responding to such threats in a timely, appropriate, and vigorous manner.

Thank you very much and I look forward to the rest of the discussion.

Footnotes

  1. Cyber attack: "An attack, via cyberspace, targeting an enterprise's use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information." National Information Assurance Glossary, http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf.
  2. The Comprehensive National Cybersecurity Initiative, http://www.whitehouse.gov/cybersecurity/comprehensive-nationalcybersecurity-initiative.
  3. "National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/HSPD23) defines cyberspace as the interdependent network of information technology infrastructures, and includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries. Common usage of the term also refers to the virtual environment of information and interactions between people." http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf
  4. National Security Council, Cybersecurity website: http://www.whitehouse.gov/administration/eop/nsc/cybersecurity.
  5. Cyberspace and the electromagnetic spectrum: "1. A global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and Embedded processors and controllers. [JP 1-02] 2. Domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures. [From "Joint Terminology for Cyberspace Operations," VCJCS memo for the Service chiefs, combatant commanders and directors of Joint Staff directorates, undated.]", Joint Operational Access Concept 2012, (Version 1.0), Chairman, Joint Chiefs of Staff, 17Jan12), p. 41, http://www.defense.gov/pubs/pdfs/JOAC_Jan%202012_Signed.pdf.
  6. http://www.fcc.gov/encyclopedia/jammer-enforcement.
  7. Denial-of-service: "The prevention of authorized access to resources or the delaying of time-critical operations. (Time-critical may be milliseconds or it may be hours, depending upon the service provided.)" National Information Assurance Glossary, http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf.
  8. In United States v. Mitra, 405 F.3d 492 (7th Cir. 2005), the defendant was convicted and sentenced under 18 U.S.C. 1030 (Cyber Crime) for intentional interference with computer-based radio systems used in interstate commerce and operated on spectrum licensed by the FCC. It met the statutory definition because the interference affected "communication." http://caselaw.findlaw.com/us-7thcircuit/1031818.html. In United States v. Trotter, 478 F.3d 918 (8th Cir. 2007), referring to United States v. Mitra, the "Seventh Circuit held the communication system harmed by the defendant's conduct was protected by the statute because it was engaged in interstate communication and, specifically, it was engaged in communication on the electromagnetic spectrum regulated by the Federal Communications Commission... Like the Internet, the spectrum is a channel of interstate commerce subject to regulation by Congress... Congress has the power to protect it." http://www.ca8.uscourts.gov/opndir/07/02/054202P.pdf.
  9. Batson, Captain Mickey & Lieutenant Commander Matthew Labart, Expanding the Non-Kinetic Warfare Arsenal. U.S. Naval Proceedings 138, no. 1. (Jan12): 41- 44.
  10. http://www.ctia.org/consumer_info/service/index.cfm/AID/10323
  11. http://www.gowirelessgogreen.org/how-we-are-helping-others/Energy-Efficient-Utilities.aspx
  12. Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update, 2011–2016, February 14, 2012, http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-520862.html.
  13. http://www.gps.gov/applications/roads/
  14. The Tech-FAQ definition: "A Denial of Service (DoS) attack is one that attempts to prevent the victim from being able to use all or part of his/her network connection." http://www.tech-faq.com/denial-of-service-dos-attacks.html.