Spoofing in Counter-UAS: Point Spoofing, Directional Redirection & GNSS Signal Takeover

GNSS signals carry an inherent design flaw that every engineer knows about: satellite transmit power is limited, and by the time a signal has traveled roughly 20,000 kilometers from orbit and reached a ground receiver, its power has attenuated to the -130 dBm range, below the ambient noise floor. A receiver can lock onto the signal because of the processing gain provided by the spreading code, not because the signal itself is strong. This characteristic means GNSS never had a “signal authenticity check” built into its design from the outset: civilian C/A code is fully public, and a receiver will unconditionally trust any signal that arrives with sufficient power and a matching code pattern.

For the past two decades this inherent flaw has been discussed repeatedly as a “security risk,” but for developers of Counter-UAS (anti-drone, hereinafter C-UAS) systems it is an engineering lever that can be turned to advantage: if a drone’s flight controller cannot itself distinguish authentic satellite signals from forged ones, then a forged signal with sufficiently convincing power, code pattern, and timing can make that flight controller “willingly” accept a set of false coordinates. This is the technical basis for GNSS spoofing in the C-UAS domain, and it is the core subject of this article.

Before laying out the three tactical applications, it is worth clarifying spoofing and jamming, two concepts that are frequently conflated, because in engineering implementation and effect control they follow two entirely different paths.

From the perspective of C-UAS system design, these two are not an either-or choice but software configurations of the same hardware platform (a multi-band GNSS transceiver) operating in different modes: the signal transmission chain of a spoofing device can be fully reused for jamming, and vice versa, with the difference lying mainly in the baseband signal generation algorithm and the higher-level control logic. This is why many C-UAS vendors label their products as “Integrated Jamming & Spoofing.”

In real C-UAS deployments, spoofing is not a single function but is divided into three tiers by intervention intensity, and the operator can select the appropriate tier based on the threat level and scenario constraints (for example, whether crashing the drone is acceptable).

Point Spoofing depends on the real-time target coordinates supplied by a radar or RF detection system as its upstream input. This is where spoofing picks up from radar-based detection: radar establishes where the drone is, and the spoofing device decides where it goes next.

In engineering terms, the system must maintain three coordinate sets: the drone’s current real-time position (continuously updated by the detection system), the device’s own deployment coordinates, and the preset target landing point. From these three coordinate sets the spoofing signal generator dynamically computes a “spoofing trajectory,” that is, the trajectory the drone’s flight controller must be made to believe it is flying along, and then adjusts transmit power, forged Doppler shift, and pseudorange in real time to guide the flight controller into a smooth descent to the preset landing point without triggering any anomaly warning.

The core advantage of this approach is a controllable landing point and a stable attitude; the drone will not lose control and crash because a position jump triggered an attitude protection response, which is critical for VIP security and industrial facility protection scenarios: you do not want a spoofed drone to suddenly lose control and fall freely over the target.

If the goal is not to land the drone but simply to drive it out of a given airspace, Directional Redirection is the more lightweight option. The system does not need to produce a precise landing point; it only needs to continuously modify the heading deviation the drone computes, so that the flight controller “believes” it is drifting off course and triggers automatic correction or return-to-home logic, with the practical effect being that the drone is lured out of the designated airspace.

This tactic is a natural fit for no-fly zone enforcement scenarios: airport approach and departure airspace, border patrol, and the outer perimeter of security for large events. The operator only needs to set a redirection bearing, and the system will continuously output the corresponding spoofing signal; the drone does not actually have to land, nor does the operator need to know its precise touchdown point. This is a more “gentle” option, better suited to non-lethal handling requirements. Redirection intensity can also be graded: from a barely perceptible slow heading drift to a pronounced forced turn, depending on the power differential and phase-shift rate between the forged and the authentic signals.

GNSS signal takeover is the deepest tier in the spoofing intensity spectrum: rather than settling for making the drone deviate or land, it continuously suppresses the power of the authentic satellite signals while completely filling the receiver’s tracking loop with the attacker’s own forged signals, so that the flight controller’s position, velocity, and heading solutions are entirely determined by the attacker. In theory, the attacker can make the drone fly any feasible trajectory, including making the flight controller misjudge that it is in an extreme attitude and thereby trigger a protective forced landing, achieving a faster resolution.

One easily confused conceptual boundary needs to be clarified here: when the industry discusses “drone takeover,” it is actually pointing to two entirely different technical paths. This article discusses takeover at the GNSS layer: deceiving the flight controller’s navigation input while the drone’s own communication link remains intact, so the drone is simply “tricked into flying.” The other path is communication protocol cracking: breaking the video and control link protocol between the drone and its remote controller (for example, cracking the frequency hopping sequence or reverse-engineering a proprietary encrypted protocol) and directly sending forged control commands to the flight controller. That is a man-in-the-middle attack at the protocol layer, entirely unrelated to whether GNSS has been spoofed, and its defenses (frequency hopping anti-jamming, protocol encryption strength) are completely different as well. Both are called “takeover” in terms of effect, but the attack surface, detection signatures, and defensive approach are two separate systems. Readers evaluating vendor proposals can easily be misled by the vague term “takeover,” so when selecting a system, always first confirm which path the vendor means.

Compared with hard-kill means such as lasers, interceptor nets, and kinetic interception, soft-kill means such as spoofing and light jamming offer clear deployment advantages in two types of scenarios:

What these two scenario types share is the requirement that the drone itself need not be struck down, which is also why spoofing sits closer to civil and quasi-military market demand than hard-kill options such as interceptor nets or kinetic interception.

GNSS spoofing and anti-spoofing detection have a fairly active open-source ecosystem in academia and the security research community, which is very helpful for understanding the underlying signal generation and detection principles:

Most of these projects are intended for academic research and security testing. C-UAS systems in actual deployment far exceed these open-source implementations in real-time signal generation, multi-band coverage, and power control precision, but the underlying principle is the same: as long as a forged signal matches the authentic signal in spreading code, Doppler shift, and pseudorange, the receiver has no ability to tell the two apart.

Spoofing technology converts the GNSS receiver’s design flaw of “unconditional trust in the signal” into a programmable soft-kill countermeasure: from the gentlest directional redirection, to point spoofing with a controllable landing point, and finally to a complete GNSS signal takeover of the navigation solution, these are essentially the same multi-band signal transmission platform under different control strategies. As one link in the complete Counter-UAS technology stack, a spoofing system usually works in coordination with radar / RF detection (which supplies real-time target coordinates) and jamming (a fallback when spoofing fails), together forming a closed loop from detection to countermeasure.