System and Method for Detecting and Localizing GNSS Spoofing Attacks Using Crowdsourced Multi-Sensor Consistency Analysis from Mobile Devices and Connected Vehicles

Abstract

GPS can be faked. A transmitter on a rooftop can broadcast counterfeit satellite signals that tell every phone and car nearby that it is somewhere it is not, and the receivers cannot tell the difference, because the genuine signals arrive weaker than background noise and carry no authentication. This disclosure turns the receivers into witnesses: each phone checks its own position five different ways, phones near each other compare notes, and the network publishes where the lies are coming from.

Disclosed is a system and method for detecting and localizing Global Navigation Satellite System (GNSS) spoofing attacks in real time using measurements already available on billions of consumer mobile devices and connected vehicles. Each participating device computes a spoof score from five on-device consistency checks: pseudorange residual analysis against the reported position, carrier-to-noise-density and automatic gain control anomaly detection, cross-source position disagreement between the GNSS fix and independent positioning sources (Wi-Fi round-trip time, cellular, inertial dead reckoning, barometric altitude, and camera visual odometry where available), GNSS clock disagreement against network time, and multi-constellation solution agreement. Devices report anonymized per-channel scores and coarse location cells to an aggregation service, and, on explicit opt-in only, time-synchronized pseudorange residuals. The service applies the decisive test, cross-device double differencing: two receivers near each other compare their pseudoranges to the same satellites, which cancels satellite and atmospheric errors under authentic signals but collapses toward zero when both receivers are tracking counterfeit signals from a single transmitter. Corroborated detections are fused into a live spoofing heatmap with tiered alerts, and a spoofer localization module estimates the transmitter position from the spatial pattern of affected receivers. On confirmed spoofing, devices fall back to authenticated signals, independent positioning, and dead reckoning rather than silently trusting the counterfeit fix.

No new hardware is needed on the phone. Android has exposed raw GNSS measurements, from which pseudorange is computed, along with carrier phase, carrier-to-noise density, and automatic gain control levels, since Android 7.0 in 2016. Modern vehicles expose the same measurements through their telematics units. The sensing layer already exists in every pocket and every fleet. What does not exist is the system that asks it the question.

For a phone user reading this: if your maps app suddenly places you in another city while your Wi-Fi still works and your compass looks sane, distrust the GPS, not the map. Close the navigation app, reopen it, and watch whether the position snaps back. A single wrong fix is a glitch. A wrong fix that every phone on your street shares at the same time is an attack, and it is worth reporting.

Field of the Invention

This invention relates to navigation security and positioning, navigation, and timing (PNT) resilience: real-time detection and localization of counterfeit GNSS signals using crowdsourced multi-sensor consistency analysis on consumer mobile devices, connected vehicles, and fixed reference stations.

Background

GPS works because a receiver can hear whispers from space and trust them. The civilian GPS L1 signal arrives at the Earth's surface at about -130 dBm, which is below the thermal noise floor in its band. The receiver finds it only by correlating against a known spreading code, a process that provides roughly 43 dB of processing gain. The signal carries no authentication. The spreading codes are public, the navigation message format is public, and the ephemeris that says where each satellite is can be downloaded by anyone. A transmitter that broadcasts a stronger copy of the same signal, with slightly altered timing, captures the receiver. The receiver has no way to know the copy is fake, because the genuine signal and the fake one are, by design, indistinguishable in form. Only their content differs, and the content is exactly what the attacker controls.

Jamming and spoofing are different failures, and the distinction decides the response. Jamming is noise: the receiver loses lock, reports no fix, and every system downstream knows it has no position. Spoofing is a lie: the receiver keeps reporting a fix, with normal-looking signal quality, and the fix is wrong. EASA treats spoofing as the greater risk for air operations, for the plain reason that a missing position is easier to handle than a convincing wrong one. A jammed aircraft switches to inertial navigation and tells the crew. A spoofed aircraft can fly toward a false waypoint while its instruments report everything normal.

The threat was demonstrated in public more than a decade ago. In June 2013, a team from the University of Texas at Austin led by Todd Humphreys was invited aboard the White Rose of Drachs, an $80 million, 65-meter superyacht sailing from Monaco to Rhodes. From the yacht's upper deck, graduate students broadcast counterfeit civil GPS signals from a briefcase-sized device they had built for about $3,000. The yacht's receivers locked onto the counterfeit signals, the autopilot corrected toward a false course, and the ship turned several hundred meters off its intended track. No alarm sounded. The chart display continued to show progress along the intended line while the ship itself was somewhere else. The experiment's point was not that a yacht could be hijacked. It was that the takeover was silent, and that the crew's instruments were the last things that would have told them.

What was a laboratory demonstration in 2013 is a daily operational input in 2026. OPSGROUP, a pilot reporting network, documented roughly 5x growth in spoofing incidents during 2024, with average daily spoofed-flight counts rising from about 300 early in the year to about 1,500 at the peak, about 1.5% of the roughly 100,000 commercial flights a day worldwide, but concentrated in Baltic and Black Sea airspace, where the share was far higher. IATA data shows more than 55,000 GPS interference incidents reported by commercial aircraft in 2025, of which about 38% were spoofing, roughly 21,000. The two headline figures measure different things: OPSGROUP's 1,500 a day is a peak rate during the worst months of 2024, while IATA's annual total averages about 58 spoofing incidents a day across 2025, mixing quiet months with bad ones. They also count different units: OPSGROUP counts estimated spoofed flights, including unreported ones, while IATA counts incidents pilots actually reported. Peaks, not averages, are what a pilot experiences. The geography is now multi-theatre: the Baltic around Kaliningrad, the Black Sea, the Eastern Mediterranean, the Persian Gulf, and the Korean Peninsula. The Baltic states report the steepest curve. Estonia reported that 85% of its commercial flights experienced GPS interference. Lithuania logged more than 1,000 interference cases in June 2025 alone, 22 times the 46 cases of June 2024. Finland's National Land Survey reported about 1,200 interference notifications in Finnish aviation in 2024, against 239 the year before, about a 5x rise. EASA published the fourth revision of its safety information bulletin on GNSS interference in July 2026, warning that incidents are growing in severity and sophistication. A single 63-hour jamming event in the Baltic in March 2024 affected more than 1,600 aircraft. Shipping, surveying, agriculture, and timing infrastructure ride on the same signals, and they report the same interference.

Existing defenses cover fragments of this problem and none of them covers the consumer device. Receiver autonomous integrity monitoring (RAIM) was built for aviation to catch faulty satellites, not hostile transmitters, and it needs redundant satellites in view plus a fault model that assumes one satellite at a time goes wrong. A spoofer falsifies all of them at once, which is exactly the case RAIM assumes cannot happen. Multi-antenna angle-of-arrival detection and controlled reception pattern antennas work, and they are deployed on military aircraft and some airliners, but they need antenna arrays and signal-processing hardware that no phone or car carries. Inertial holdover works until it drifts: a consumer-grade inertial measurement unit accumulates tens of meters of error within a minute of unaided dead reckoning, and minutes are longer than most spoofing events last. Galileo's Open Service Navigation Message Authentication (OSNMA) is the first real fix at the signal layer, and it entered its initial operational service on July 24, 2025, making Galileo the first GNSS to offer open authentication to civil users. But OSNMA authenticates Galileo navigation messages only. It does not authenticate GPS, GLONASS, or BeiDou. It requires receiver support, a time sync within tens of seconds, and a Galileo-capable receiver, and the billions of GPS-only and GPS-primary receivers already deployed will never get it. GPS has no civil authentication service, and none is in service today.

The research groundwork for a crowdsourced answer is already published. Sherman Lo and colleagues at Stanford demonstrated in 2019 that networked smartphones, using the raw GNSS measurements Android exposes, could detect spoofing by comparing positions, accelerations, automatic gain control levels, and pseudoranges across devices, including in a live over-the-air spoofing test. Researchers at Tampere University published a consistency-check method in 2025 that models spoofing from Android raw pseudorange measurements and mitigates it iteratively, testing across bus, walk, ferry, car, flight, and bike scenarios. Olsson and Nilsson showed in 2023 that a participatory network of phones reporting carrier-to-noise-density measurements could locate a jammer with a median error of 50 meters using a single Samsung S20+ as the sensor. At the Institute of Navigation's 2026 Joint Navigation Conference, Humla Navigation presented a nationwide smartphone crowdsourcing system for detecting and locating jammers and spoofers, building on the J911 concept first proposed in 2011, and reported locating a jammer placed in a city center from smartphone measurements. Separately, the volunteer GPSJam map has shown since 2022 that crowdsourced aircraft reports can render interference geography in near real time. Each of these proves one piece. None of them ships the whole system: on-device scoring from five independent checks, cross-device double differencing as the decisive test, a live heatmap with tiered alerting, spoofer localization, and a defined fallback, packaged as a service that runs on hardware already in pockets and fleets.

Two distinctions are worth stating, because they are where this disclosure differs from the nearest prior work. Lo and colleagues compared pseudoranges across receivers; this disclosure adds the double-difference formulation with carrier-phase smoothing, which cancels the common-mode errors a direct comparison leaves in, and wraps the test in tiered, corroboration-gated alerting with a defined fallback stack. Humla's system, as described in its conference abstract, detects, characterizes, and locates jammers and spoofers; the abstract discloses no fusion formula, no double-difference collapse test, no corroboration-gated tiers, and no fallback stack. The combination is the claim, not any single check.

Adjacent disclosures in this series cover parts of this ground. LITF-PA-2026-060 treats a vehicle fleet's GNSS receivers as a distributed sensor network, but it measures the atmosphere, not the signal. LITF-PA-2026-132 detects anomalous vehicle trajectories from license plate reads, a different sensor and a different threat. LITF-PA-2026-151 puts a software-defined radio in a consumer's hands, and it establishes the price point this disclosure relies on: a HackRF One costs about $350 and tunes 1 MHz to 6 GHz. LITF-PA-2026-059 maps buried utilities from magnetic anomalies, which is the same pattern of turning an incidental sensor into a map, applied to a different field. No disclosure in the series detects counterfeit GNSS signals, localizes the transmitter, or tells a device what to trust when the sky is lying.

What is missing is a system that treats the world's phones and vehicles as a spoofing sensor network, scores each device locally, confirms across devices, publishes where the lies are, and gives every device a trustworthy fallback. The hardware is already deployed. The measurements are already exposed. The protocol that turns isolated receivers into witnesses that can corroborate each other is the part nobody has built.

Detailed Description

1. System Architecture

Three layers make up the system. The fleet itself is the sensing layer: smartphones running an operating-system service or an application, connected vehicles through their telematics units, and fixed reference stations installed at surveyed locations. Each sensing agent runs the same on-device scoring pipeline described in section 2 and produces the same compact report. A regional service does the aggregating: it receives reports, runs the cross-device tests of section 3, maintains the heatmap of section 5, and publishes alerts. Every system that needs to know whether to trust its position consumes the output: aviation briefing feeds, maritime navigation systems, fleet dispatch, ride-hailing and delivery routing, surveying equipment, and the phone in a pedestrian's pocket.

A report is small and deliberately coarse. It contains: a 1-kilometer grid cell identifier, not a precise position; the five per-channel scores of section 2, each quantized to 4 bits; a timestamp synchronized to network time; the device class (phone, vehicle, fixed station); and, on explicit opt-in only, a compact pseudorange residual vector for the satellites in view. A routine heartbeat report is under 200 bytes and is sent at most once per minute. An anomaly report is sent immediately when any channel score exceeds 0.5. Nothing in a routine report carries a device identifier or identifies the device's owner. Reports are retained for 24 hours in raw form and then reduced to cell aggregates, which are kept indefinitely as the historical interference record.

Fixed reference stations anchor the whole network. A reference station is a surveyed dual-frequency GNSS receiver at a known position, typically on a rooftop or a cell tower, costing about $500 in hardware at volume. It runs the same five checks, but its known position makes its verdict far stronger than a phone's: a reference station whose reported position moves at all is, by definition, tracking a counterfeit signal or a fault, and there is no multipath ambiguity to argue about. One reference station per 50-kilometer radius in a hotspot region is enough to corroborate phone reports across that region. The Baltic, the Black Sea coast, the Eastern Mediterranean, and the Persian Gulf are the first deployment targets, because that is where the interference already is.

2. On-Device Consistency Checks

Each device computes five channel scores from measurements it already has. Each score is normalized from 0 to 1 between a noise floor and an action level, using fixed starting thresholds that the device replaces with learned per-device values after 30 days of operation in clean conditions. The five channels mostly fail for different reasons, which is what makes their agreement meaningful: a single channel can be fooled or can false-alarm, but five channels failing together, in the same direction, at the same time, is the signature of a counterfeit signal. One qualification matters. Channel A's reference position comes from the fusion in channel C, so those two share a failure mode. The double-difference test in section 3 is the check that depends on neither.

Channel A: pseudorange residual. The receiver computes its position from all satellites in view, then measures how far each satellite's pseudorange deviates from the range implied by that position. Under authentic signals the residual root-mean-square stays near the receiver's noise level, typically 1 to 3 meters for a phone. Under spoofing, the counterfeit pseudoranges are consistent with a false position, not with the true one, so the residuals grow when the true position is known from any independent source, and the residual pattern across satellites becomes correlated rather than random. The score is P = clamp((rms - 2) / 8, 0, 1), where rms is the residual RMS in meters: 0 at 2 meters or below, 1 at 10 meters or above. This is the RAIM idea, run on a phone, with the difference that the reference position comes from the fusion in channel C rather than from the satellites themselves.

Channel B: carrier-to-noise density and automatic gain control. A spoofer must overpower the authentic signals to capture the receiver, and overpowering leaves a fingerprint in the receiver's front end. Two effects appear together. First, the mean carrier-to-noise-density ratio (C/N0) across all tracked satellites jumps upward, typically by 5 to 10 dB-Hz, and the values converge: authentic signals vary by satellite elevation and antenna orientation, while counterfeit signals arrive from one direction at one power level. Second, the automatic gain control reduces its gain as total in-band power rises, so the AGC reading drops at the same moment the C/N0 values jump. Either effect alone can have an innocent cause, and a strong nearby legitimate interferer can mimic parts of the pattern. A C/N0 jump with a simultaneous AGC drop and a convergence of C/N0 values across satellites has no common innocent cause. The score is C = clamp((jump - 2) / 6, 0, 1), where jump is the rise in mean C/N0 in dB-Hz relative to the device's learned baseline: 0 at 2 dB-Hz or below, 1 at 8 dB-Hz or above. The AGC drop is used as a gating condition: the score is halved when the AGC does not drop, because a genuine signal improvement, such as stepping outdoors, raises C/N0 while barely touching the AGC.

Channel C: cross-source position disagreement. The phone already knows where it is from sources that do not depend on satellites. Wi-Fi round-trip time to known access points gives 1 to 2 meter accuracy indoors and in cities. Cellular positioning gives tens of meters. The inertial measurement unit carries the last trusted fix forward by dead reckoning. The barometer gives altitude to within a few meters. Where a camera is available, visual odometry tracks motion relative to the visual scene. The device fuses these into an independent position estimate and compares it with the GNSS fix. The score is X = clamp((d - 15) / 85, 0, 1), where d is the disagreement in meters: 0 at 15 meters or below, 1 at 100 meters or above. This channel is the one that catches the crude spoofers, the ones that teleport the receiver hundreds of meters or kilometers in a single epoch. It is also the channel most vulnerable to false alarms in cities, where Wi-Fi positioning has its own errors, which is why its weight is balanced against the double-difference test of section 3 rather than trusted alone.

Channel D: clock disagreement. A spoofed signal carries spoofed time. The receiver's GNSS clock is compared against network time from NTP or the cellular network's time broadcast. The score is T = clamp((jump - 1) / 99, 0, 1), where jump is the change in the disagreement between the GNSS clock and network time relative to the device's learned offset, in milliseconds: 0 at a jump of 1 millisecond or below, 1 at a jump of 100 milliseconds or above. Two details complicate it. First, cellular network time can itself be off by tens of milliseconds, so the check uses a learned per-device offset and flags sudden jumps in the disagreement, not the absolute offset. A phone whose GNSS clock and network clock have disagreed by 40 milliseconds for a month is not under attack. A phone whose disagreement jumps from 40 to 400 milliseconds in one epoch is. Second, a sophisticated spoofer can keep its counterfeit time close to true time, so this channel is a tripwire for crude spoofers, not a guarantee against careful ones. Its weight is tied with the multi-constellation check for the smallest of the six, for exactly that reason.

Channel E: multi-constellation agreement. A modern phone tracks GPS, Galileo, GLONASS, and BeiDou simultaneously, and most spoofers fake one constellation, usually GPS L1, because faking four constellations with consistent geometry requires four times the hardware and a far more careful signal design. The device computes a position from each constellation separately and compares them: under authentic signals the constellation-only solutions agree within a few meters, while under single-constellation spoofing they diverge by the spoofed offset. The resulting score, E = clamp((div - 10) / 90, 0, 1), where div is the largest pairwise disagreement between constellation-only solutions in meters, runs 0 at 10 meters or below and 1 at 100 meters or above. Where the receiver supports Galileo OSNMA, the authenticated Galileo solution is treated as the reference and compared against the GPS solution directly, which turns this channel from a consistency check into an authentication check.

3. Cross-Device Double Differencing

The five on-device checks can each be argued with. The cross-device test is harder to argue with than any single-device check, because it cancels the errors a single receiver cannot separate. It is the decisive test, and it is the part of this disclosure that turns isolated receivers into a network.

Two receivers near each other, within about 1.5 kilometers, observe the same satellites. If each receiver reports its pseudoranges to the same satellite, differencing the two receivers' measurements cancels the satellite clock error, the satellite orbit error, and most of the ionospheric and tropospheric delay, because those errors are common to both receivers over a short baseline. What remains in the double difference is receiver noise, multipath, and any error that is not common between the two receivers. Under authentic signals, the double-difference residuals for a pair of phones a few hundred meters apart are typically 2 to 5 meters RMS, dominated by multipath and the phones' cheap antennas. Under a single-transmitter spoof, both receivers track the same counterfeit signals from the same antenna, so the counterfeit geometry error cancels in the difference and the residuals fall to the receivers' own noise floor. Raw code noise alone would leave that floor at 1.4 to 4.2 meters, which overlaps the authentic range and would make the test useless. The test works because each receiver first smooths its pseudoranges with its carrier phase, using a Hatch filter over a 30 to 60 second window: Android exposes the carrier phase each phone needs for this, and smoothing cuts the code noise roughly fivefold, to about 0.2 to 0.5 meters, while multipath, which varies slowly, survives the smoothing. The asymmetry is the point. Under authentic signals the smoothed double-difference residuals stay at 2 to 5 meters, because differential multipath dominates and smoothing cannot remove it. Under a single-transmitter spoof they collapse to about 0.3 to 0.7 meters, because the counterfeit signal is strong enough to dominate each receiver's multipath and the common geometry error cancels. The collapse is the signature. A receiver can be wrong about its own position for many reasons. Two receivers producing nearly identical pseudorange errors is the signature of a shared transmitter: independent receiver noise differs between devices, so near-identical errors point to one source.

The score is DD = clamp((2.5 - dd_rms) / 2, 0, 1), where dd_rms is the carrier-phase-smoothed double-difference residual RMS in meters across the satellites both receivers track: 0 when dd_rms is 2.5 meters or above, 1 when it is 0.5 meters or below, linear between. The test requires the two reports to be synchronized within 100 milliseconds, which network time provides, and it requires a known baseline between the receivers, which comes from their reported grid cells, their Wi-Fi and cellular positions, or, for fixed stations, their surveyed coordinates. Pairs are formed only between devices in the same or adjacent grid cells, which bounds the baseline to about 2.8 kilometers in the worst diagonal case; pairs with baselines over 1.5 kilometers are down-weighted, because the common-error cancellation weakens with distance. A device with no neighbor in an adjacent cell cannot run this test, and its DD score defaults to 0.5, neither evidence for nor against spoofing, until a neighbor appears. That default is a deliberate design choice: a lone device should never be convicted on a test it could not run. The test runs only among devices that have opted into residual sharing, so its coverage follows the opt-in rate; a region with few opted-in devices has few pairs, and the corroboration rules in section 5 already account for that by capping a lone device below Confirmed.

Three properties make the double-difference test hard for an attacker to defeat. First, defeating it requires one transmitter per victim, with each transmitter generating a self-consistent set of counterfeit signals matched to that victim's true position, which multiplies the attacker's hardware and synchronization burden by the number of victims. Second, the test uses measurements the attacker cannot see: the attacker does not know the victims' reported pseudoranges, so it cannot tune its signals to produce a plausible double difference. Third, the test improves as the network densifies: more neighbors means more pairs, and a spoofer that fools one pair is caught by the next. The test's weakness is the same as its strength: it needs density. A single phone on an empty road at 3 a.m. has no corroborator, and the system says so openly by leaving its DD score at 0.5 and capping its total score below the Confirmed tier.

4. Spoofer Localization

Detection says a lie is in the air. Localization says where it is coming from, and that is what lets anyone do something about it. The localization module runs on the aggregation service once a cell reaches the Alert tier, and it needs three or more reporting devices in or near the affected cells.

The estimator is a grid search. The service lays a grid over the affected area at 100-meter spacing and, for each candidate transmitter position, predicts what each reporting device should observe: the received power of the counterfeit signal falls with the square of the distance from the transmitter, so devices nearer the transmitter report larger C/N0 jumps and larger AGC drops, and the double-difference collapse is strongest between device pairs nearest the transmitter. The candidate position that best explains the observed spatial pattern of C/N0 jumps, AGC drops, and double-difference collapses wins. The output is an estimated transmitter position with a confidence ellipse and an affected radius, the distance within which a receiver is likely to be captured. In dense urban areas with many reporting devices, the expected accuracy is tens of meters: the analogous participatory result for jammer localization reported a median error of 50 meters from a single phone model as the sensor. In sparse areas with three devices and long baselines, the ellipse widens to hundreds of meters, and the system reports the ellipse honestly rather than a false point.

The estimate sharpens further in two ways. First, where a reporting device has a dual-antenna receiver, its measured angle of arrival to the counterfeit signal constrains the transmitter to a bearing line, and two bearing lines from different devices intersect at the transmitter. Second, where the affected area borders a clean area, the boundary between spoofed and clean cells traces the transmitter's effective range, and the range combined with the known transmit power of a typical spoofer constrains the distance. Neither refinement is required. The grid search runs on C/N0 gradients alone and improves as more devices report.

Localization has a second use beyond enforcement: it separates one spoofer from many. A single transmitter produces one smooth spatial pattern. Two transmitters produce two lobes with a seam between them, and the grid search reports two peaks. That distinction matters operationally, because a single spoofer is a device to find and a pattern of spoofers is a campaign to track.

5. Heatmap, Tiers, and Worked Examples

Cell scores aggregate into a live spoofing heatmap. Each 1-kilometer cell holds a rolling 15-minute spoof score, computed as the reputation-weighted mean of the reporting devices' scores in that cell, and a device count. Cells are published on a public map with a 5-minute delay and a coarse resolution, so that a pilot planning a route, a ship's master, or a fleet dispatcher can see where the sky is untrustworthy before entering the area. The delay and the coarse resolution are deliberate: a real-time, meter-accurate map of spoofing would also be a real-time map of where navigation is blind, which is useful to an attacker planning where to operate. A public tier map still reveals where navigation is blind, and that residual intelligence value is accepted as a tradeoff, because the same map warns the far larger number of legitimate users who need it.

The six channel scores fuse into a single spoof score S = 0.30 × DD + 0.20 × X + 0.15 × P + 0.15 × C + 0.10 × E + 0.10 × T, where DD is the double-difference collapse, X the cross-source disagreement, P the pseudorange residual, C the C/N0 and AGC anomaly, E the multi-constellation disagreement, and T the clock disagreement. The weights are provisional until measured, and the formula is stated so the table below can be checked by hand. Tiers run: Clear below 0.30, Watch from 0.30 to below 0.55, Alert from 0.55 to below 0.75, and Confirmed at 0.75 and above. A cell reaches Confirmed only with corroboration: three independent attested devices, or one device plus a reference station, or two devices with a double-difference collapse between them. A single device, however confident, can reach Alert at most. That corroboration rule is the system's main defense against both false alarms and fabricated reports.

S = 0.30 × DD + 0.20 × X + 0.15 × P + 0.15 × C + 0.10 × E + 0.10 × T. Channel values are illustrative inputs, not measurements.

Case	DD	X	P	C	E	T	S	Tier
Healthy phone, open sky	0	0	0	0	0	0	0.00	Clear
Urban canyon multipath	0	0.24	0.31	0	0.10	0	0.10	Clear
Lone phone spoofed, no neighbors	0.50	1.00	0.50	0.67	1.00	0.49	0.67	Alert
Two trucks spoofed by one transmitter	1.00	1.00	0.88	0.83	1.00	1.00	0.96	Confirmed
Jamming only, no spoofing	0	0.06	1.00	0	0.02	0	0.16	Clear

The DD column defaults to 0.5 where no neighbor pair exists, which is the lone-phone row; every other row assumes a neighbor pair is available. The jamming row scores Clear: the cell is reported as interference, not spoofing.

Read the jamming row first. It is the case that proves the system is measuring spoofing and not just interference. Jamming drives the pseudorange residual to its maximum, because the receiver is struggling, but it produces no C/N0 jump, no cross-source disagreement beyond noise, no clock jump, and no double-difference collapse, so the score stays at 0.16 and the cell is reported as interference, not spoofing. The response to interference is holdover and patience. The response to spoofing is distrust and fallback, and confusing the two would teach users to ignore the alert that matters.

Read the lone-phone row next. It is the case that bounds what a single device can prove. Every channel fires except the double-difference test, which defaults to 0.5 because there is no neighbor to compare against, and the score reaches 0.67, which is Alert but not Confirmed. That is the honest ceiling for a lone witness. The phone warns its user and reports to the service, and the service waits for a second witness before telling the world.

Tier changes drive different consumers. Watch appears on the public heatmap as a shaded cell. Alert notifies fleet operators and aviation briefing feeds for the affected area, and phones in the cell show a quiet notice that positioning may be unreliable. Confirmed triggers a push to aviation and maritime authorities, a notice to timing-infrastructure operators, and a visible warning on every participating device in the cell, showing the affected area; the estimated spoofer location goes to civil aviation and maritime authorities through existing reporting channels, and is never shown on devices or the public map. The alert always names its evidence: which channels fired, how many devices corroborated, and whether a reference station agreed.

6. Authenticated Fallback and Holdover

Detecting a lie is only half the job. The device still needs to know where it is. On a Confirmed tier, the device stops trusting its GNSS fix and switches to a fallback stack, in order of preference. First, it uses Galileo OSNMA-authenticated satellites only, in strict mode, where the receiver supports it: the authenticated solution is the most trustworthy satellite position available while the attack runs, but it is not proof against every attacker. OSNMA authenticates the content of the navigation message, not the ranging code itself, so a spoofer that records authentic signals and replays them with a delay, a meaconing attack, or one that estimates and regenerates the secure code, can pass the authentication check. The fallback treats the OSNMA solution as the best available satellite fix, not as a guarantee, and it keeps the cross-source checks running against it. Second, it uses independent positioning: Wi-Fi round-trip time, cellular positioning, barometric altitude, and inertial dead reckoning fused with map matching, which in a city holds a few tens of meters for minutes. Third, it holds its last trusted fix and grows an uncertainty ellipse around it at the dead-reckoning drift rate, so the user sees a position that gets honestly vaguer rather than confidently wrong. Timing users, who depend on GNSS for network synchronization rather than position, switch to network time plus local oscillator holdover, which holds within microseconds for hours on an oven-controlled oscillator and drifts milliseconds per hour on a temperature-compensated one.

What makes the fallback work is not its layers but two guarantees. The fallback is never silent: the device shows a degraded-position state, with the uncertainty ellipse visible, so a user or an autopilot knows the position is an estimate and not a fix. And the fallback never re-trusts GNSS on its own: the device returns to satellite positioning only when its spoof score has stayed below the Watch threshold for five consecutive minutes, or when the user explicitly overrides. A spoofer that switches off for thirty seconds and back on is the oldest trick in this field, and a fallback that re-trusts on the first clean epoch falls for it every time.

7. Privacy and Abuse Resistance

A network that watches every phone's position is a surveillance network, and this disclosure refuses to build one. Routine reports carry a 1-kilometer grid cell, not a position, and no device identifier. The aggregation service is designed so it cannot reconstruct a device's track from its reports, because the reports do not contain a track: they contain a cell and six numbers. Pseudorange residual vectors, which are the most sensitive payload, are sent only on explicit opt-in, and they are retained for 24 hours. Cell aggregates are the permanent record, and a cell aggregate cannot be traced to a person.

That anonymity claim needs one honest qualification, because the same section also requires attestation and reputation. Device attestation and reputation weighting work by linking a device's reports across time, which requires some persistent identity. The reconciliation is rotating pseudonyms. Each device reports under a pseudonymous identifier that rotates daily and is never linked to an account, a phone number, or a precise position. Reputation is stored against the current pseudonym only, and it resets when the pseudonym rotates, so a device's history evaporates every 24 hours. That reset is a real cost to the weighting defense: a device that has reported honestly for months is, to the service, a new device every morning, and a long-lived attacker can likewise shed a bad reputation by waiting out the rotation. The design accepts that cost because the alternative, a permanent device identity, would turn the service into a tracking system. Within a single day, a pseudonym's reports can still be linked by cell, timestamp, and device class, and in a sparse cell that linkage can single out a device even without residual vectors, which is why routine reports are quantized to 4-bit scores and why the service discards raw reports after 24 hours. Attestation as a gatekeeper has an equity cost as well: users on older, de-Googled, or unsupported devices fail attestation and carry half weight, so their reports count for less. The design accepts that cost because unattested reports are also the cheapest to fabricate, but it is a real exclusion, and reference stations exist partly to anchor regions where attested devices are scarce. The residual-vector fingerprinting risk is real and is stated here: in a sparse rural cell, a 1-kilometer cell plus a timestamp plus a residual vector can single out one device, which is why residual vectors are opt-in only and never sent in routine reports. "Cannot reconstruct a track" is a design goal with stated exceptions, not an absolute.

The network also has to survive being lied to. A fabricated report is cheap to send, so the aggregation service weights reports by attestation and reputation. Devices that pass platform attestation (Android Play Integrity or Apple App Attest) and have a history of reports consistent with their neighbors carry full weight. Unattested devices carry half weight. A device whose reports repeatedly disagree with its neighbors loses weight over time, and a burst of new unattested devices reporting the same anomaly from the same cell is treated as a single witness, not many. A cell reaches Confirmed only with corroboration from attested devices or a reference station, so an attacker flooding fake reports can raise a Watch at most, and a Watch on the public map that no real device corroborates is visible as exactly that: uncorroborated.

The reference stations are the anchor against a coordinated fabrication attack. A reference station's position is surveyed and public, its receiver is a known model, and its reports are signed. An attacker that wants to fabricate a Confirmed cell must either compromise a reference station or field enough attested devices to outvote the honest ones in that cell, and both are expensive in a way that sending fake reports is not.

8. Governance, Consent, and Failure Modes

The aggregation service is a single point of trust, and the disclosure states what governs it. The service is operated as a public-interest utility, not as a product: its code is open source, its heatmap data is public, and its alerting API is free. It publishes a data-access policy stating what it stores, for how long, and under what legal process it discloses anything, and it is subject to independent audit. The failure mode to design against is a compromised or compelled service publishing a false "Clear" during an attack, which would be worse than no service at all. Three defenses apply. Cell scores are signed with the service's key and each report is traceable to its cell aggregate, so a fabricated heatmap is detectable by anyone who replays the public aggregates. Reference stations sign their own reports, so a service that suppresses a reference station's alarm leaves a gap a third party can spot. And devices keep their own on-device scores, so a phone that sees spoofing warns its user even if the service says Clear.

Participation is opt-in, and the opt-in is explicit. The operating-system service path asks the user once, in plain language, whether their phone may report anonymized interference measurements, and it says what is reported and what is not. The user can opt out at any time, and opting out stops all reporting while leaving the on-device detection and fallback working locally. Fleet participation is decided by the fleet operator for its own vehicles, and drivers are told. No silent background reporting is part of this design.

Alert fatigue is a failure mode, not a nuisance. A system that warns a city driver every day will teach that driver to ignore the warning, and the warning that matters will arrive the week the driver stopped listening. Two rules bound the noise. First, a phone shows a quiet notice only at Alert or above, and only once per cell per day unless the tier rises. Second, the aggregation service publishes its false-Alert rate per region, measured against reference stations, so a region whose multipath environment produces frequent false Alerts gets wider thresholds rather than louder warnings. The worked example's urban-canyon case at 0.10 is a single scenario, not a false-alarm analysis, and the disclosure does not pretend otherwise.

A false Confirmed has operational consequences the design must own. It pushes aviation and maritime authorities, warns every device in the cell, and can divert flights, distrust timing infrastructure, and trigger incident response. Corroboration is the first defense, and the second is reversibility: a Confirmed cell that loses its corroboration within 15 minutes is downgraded with the same prominence as the original alert, and the downgrade names the reason. Liability for a false alert sits with the operator of the service, which is another reason the service is a public-interest utility with published accuracy figures rather than a black box.

Localization output is degraded in active electronic-warfare environments. The first deployment targets named in section 1, the Baltic, the Black Sea, the Eastern Mediterranean, and the Persian Gulf, are regions where spoofing is state military electronic warfare, and a system that publishes estimated transmitter positions in near real time in those theatres is close to targeting data. The public map therefore shows cell tiers only, never an estimated transmitter position. Precise localization is shared with civil aviation and maritime authorities through existing reporting channels, not published. In an active conflict zone, the service withholds even the cell tier if the tier itself would reveal a military capability, and says so on the map. Active conflict zone status follows the EASA list of affected regions and the operator's own assessment, and the decision and its reason are published on the map. Precise localization shared with authorities can also enable kinetic targeting, and the disclosure does not solve that: recipient authorities are the civil aviation and maritime bodies that already receive interference reports, the chain of custody is the existing reporting channel, and the service publishes which authorities received which localization, so misuse is at least visible. "Lets anyone do something about it" means the authorities whose job it is, not anyone with a browser.

One dual-use tradeoff is acknowledged directly. Describing how to defeat this defense, one transmitter per victim, counterfeit time kept close to true time, multiple constellations faked at once, hands an attacker the recipe for the attack this system exists to catch. The disclosure includes those defeat modes because a defense whose failure modes are secret cannot be evaluated, and because every attack mechanism described here is already public: the signal structure, the spreading codes, the 2013 yacht demonstration, and the open-source signal-generation software. Publishing the thresholds also lets an attacker tune its signals to stay just below them; the per-region learned thresholds and the corroboration requirement exist partly to blunt that, but a patient attacker can trade effectiveness for stealth, and the disclosure does not pretend otherwise. What is new here is the defense, not the attack, and the defense is published so it can be built, not so the attack can be refined.

9. Figures Description

• Figure 1: System architecture: sensing agents (phones, vehicles, reference stations), the on-device scoring pipeline with five channels, the aggregation service, and the consumers (aviation briefing, maritime navigation, fleet dispatch, consumer devices).
• Figure 2: The double-difference test: two receivers near each other tracking the same satellites, showing pseudorange residuals that cancel under authentic signals and collapse toward zero under a single-transmitter spoof.
• Figure 3: Carrier-to-noise-density traces for authentic signals (varied by satellite elevation) versus spoofed signals (elevated and converged), with the simultaneous automatic gain control drop marked.
• Figure 4: Spoofer localization grid search: a map with reporting devices, their C/N0 jump magnitudes, and the estimated transmitter position with its confidence ellipse.
• Figure 5: The live spoofing heatmap for a region, with cells colored by tier and the public advisory text shown to devices in the area; the estimated spoofer location is shared with authorities only and is not marked on the public map.
• Figure 6: Fallback stack diagram: GNSS fix distrusted, Galileo OSNMA strict-mode solution, Wi-Fi and cellular positioning, inertial dead reckoning with a growing uncertainty ellipse, and the return-to-trust rule.

Implementation Notes

The installed base is covered by three deployment paths, none of which needs new hardware. The first is an operating-system service: Android already exposes the raw measurements through its GNSS APIs, and a system service can run the five checks, report on anomaly, and drive the fallback stack for every application on the phone at once. The second is a fleet telematics SDK: delivery, trucking, and ride-hailing fleets already run always-on location services, and their vehicles are dense in exactly the cities where spoofing is hardest to notice and easiest to hide. The third is receiver firmware: aviation, maritime, and surveying receivers already run integrity monitoring, and the double-difference test can be added as a firmware update wherever the receiver can share measurements with a neighbor over an existing data link.

Adoption has a cold-start problem, and the disclosure states it plainly. The double-difference test needs density, and density needs users, and users need a reason to install. The bootstrap is fleets and fixed stations in hotspot regions: a few hundred vehicles and a dozen reference stations across the Baltic states would cover the densest spoofing geography on Earth, and the heatmap they produce is the demonstration that recruits the next region. Consumer adoption follows the OS path, which needs one decision by one platform vendor, not a million decisions by a million users.

Costs are the cost of software and a small server fleet, not of hardware. Phones need no new sensor. Vehicles need a software update to their telematics unit. A reference station is about $500 in hardware at volume, plus a rooftop and power. The aggregation service is a regional stream processor: at one report per device per minute, a million participating devices produce about 17,000 reports per second, which is a modest streaming workload, and the anomaly path is a fraction of that. The expensive part is not the infrastructure. It is the first year of data in a hotspot, which is a measurement exercise, not a capital program.

Calibration is per device and per region, not global. The 30-day learning window builds each device's baselines for C/N0, AGC, and clock offset, and the device re-learns after any operating system update that changes its GNSS stack. Regional thresholds adapt to the local multipath environment: a dense downtown needs wider disagreement bounds than an open highway, and the aggregation service publishes per-region threshold recommendations derived from its own clean-condition history.

Claims

1. A system for detecting GNSS spoofing attacks, comprising: a plurality of sensing agents, each comprising a GNSS receiver configured to output raw GNSS measurements including pseudorange, carrier-to-noise-density ratio, and automatic gain control levels; an on-device scoring module on each sensing agent configured to compute a spoof score from a plurality of consistency checks; and an aggregation service configured to receive anonymized reports from the sensing agents, to apply a cross-device double-difference test to pairs of reports from nearby sensing agents, and to publish a spoofing heatmap with tiered alerts.
2. The system of claim 1, wherein the plurality of consistency checks comprises: a pseudorange residual check comparing measured pseudoranges against ranges implied by an independently derived position; a carrier-to-noise-density and automatic gain control anomaly check detecting simultaneous rises in mean carrier-to-noise-density ratio and drops in automatic gain control; a cross-source position disagreement check comparing the GNSS fix against an independent position derived from Wi-Fi round-trip time, cellular positioning, inertial dead reckoning, barometric altitude, or camera visual odometry; a clock disagreement check comparing GNSS time against network time using a learned per-device offset; and a multi-constellation agreement check comparing position solutions computed separately from different GNSS constellations.
3. The system of claim 1, wherein the cross-device double-difference test comprises: differencing pseudorange measurements from two sensing agents within about 1.5 kilometers observing the same satellites, wherein common satellite clock, orbit, and atmospheric errors cancel; computing a double-difference residual root-mean-square; and scoring the pair as spoofed when the residual root-mean-square collapses below a threshold, indicating both sensing agents are tracking counterfeit signals from a single transmitter.
4. The system of claim 3, wherein a sensing agent with no neighboring sensing agent in an adjacent location cell defaults its double-difference score to a neutral value of 0.5, and wherein the sensing agent's total spoof score is capped below a confirmed tier until corroboration from another sensing agent or a reference station is available.
5. The system of claim 1, further comprising a spoofer localization module configured to estimate a transmitter position by grid search over candidate positions, minimizing the difference between predicted and observed spatial patterns of carrier-to-noise-density jumps, automatic gain control drops, and double-difference collapses across reporting sensing agents, and to output the estimated position with a confidence ellipse and an affected radius.
6. The system of claim 1, wherein the aggregation service distinguishes spoofing from jamming, wherein jamming is reported as interference when the pseudorange residual check fires without a threshold-exceeding carrier-to-noise-density jump, cross-source disagreement, clock disagreement, or double-difference collapse, and wherein the response to interference is holdover and the response to spoofing is distrust and fallback.
7. The system of claim 1, further comprising a fallback module on each sensing agent configured, on a confirmed spoofing tier, to distrust the GNSS fix and to fall back in order to: an authenticated Galileo OSNMA strict-mode solution where supported; independent positioning from Wi-Fi, cellular, barometric, and inertial sources with map matching; and holdover from the last trusted fix with a growing uncertainty ellipse, wherein the fallback is displayed to the user as a degraded-position state and wherein the sensing agent returns to satellite positioning only after the spoof score remains below a watch threshold for five consecutive minutes.
8. The system of claim 1, further comprising a plurality of fixed reference stations at surveyed positions, each configured to run the same consistency checks, wherein a reference station whose reported position moves is treated as tracking a counterfeit signal, and wherein reference station reports corroborate sensing agent reports for tier escalation.
9. The system of claim 1, wherein each anonymized report contains a coarse location cell identifier of about one kilometer, quantized per-channel scores, a timestamp, and a device class, and contains no device identifier other than a rotating pseudonymous identifier used only for attestation and reputation weighting, and no precise position, and wherein raw pseudorange residual vectors are transmitted only on explicit opt-in, and are retained for at most 24 hours.
10. The system of claim 1, wherein the aggregation service weights reports by device attestation and reputation, wherein unattested devices carry reduced weight, wherein devices whose reports repeatedly disagree with neighboring devices lose weight, and wherein a burst of reports from new unattested devices in one cell is treated as a single witness.
11. The system of claim 1, wherein a cell reaches a confirmed tier only with corroboration from three independent attested sensing agents, or one sensing agent plus a reference station, or two sensing agents with a double-difference collapse between them, and wherein a single sensing agent can reach an alert tier at most.
12. The system of claim 1, wherein the clock disagreement check flags sudden jumps in the disagreement between GNSS time and network time relative to a learned per-device offset, rather than the absolute offset, wherein a stable offset is treated as normal and a jump is treated as evidence of spoofing.
13. The system of claim 1, wherein the multi-constellation agreement check treats an authenticated Galileo OSNMA solution as the reference and compares the GPS solution against it directly, converting the consistency check into an authentication check where OSNMA is supported.
14. A method for detecting and localizing GNSS spoofing attacks, comprising: computing, on each of a plurality of mobile devices, a spoof score from pseudorange residual analysis, carrier-to-noise-density and automatic gain control anomaly detection, cross-source position disagreement, clock disagreement, and multi-constellation agreement; reporting anonymized per-channel scores to an aggregation service, and reporting time-synchronized pseudorange residuals only on explicit opt-in; applying a cross-device double-difference test to pairs of nearby devices to detect a single shared counterfeit transmitter; localizing the transmitter by grid search over the spatial pattern of affected devices; publishing a tiered spoofing heatmap; and, on a confirmed tier, switching affected devices to authenticated signals, independent positioning, and dead reckoning.

Prior Art References

1. University of Texas at Austin, "UT Austin Researchers Successfully Spoof an $80 million Yacht at Sea" (July 29, 2013): briefcase-sized spoofer built for about $3,000 took over the White Rose of Drachs with no alarms
2. Bhatti, J. and Humphreys, T.E., "Hostile Control of Ships via False GPS Signals: Demonstration and Detection," NAVIGATION, Journal of the Institute of Navigation: the yacht experiment in full, including detection discussion
3. FlySafe, "GNSS Interference Trends, 2024 to 2026 Industry Synthesis" (May 20, 2026): consolidates the OPSGROUP GPS Spoofing Final Report (about 5x growth in 2024, about 300 to about 1,500 spoofed flights per day), EASA and Eurocontrol action plans, and FAA guidance
4. FlySafe, "GPS Interference Incidents 2025" data page: IATA data showing 55,200 GPS interference incidents reported by commercial aircraft in 2025, 62% jamming (34,200) and 38% spoofing (about 21,000)
5. Quartz Mountain, "A Busy Sky: Counting Daily Air Traffic": about 99,709 commercial flights per day worldwide
6. New Scientist, "Unprecedented GPS jamming attack affects 1600 aircraft over Europe" (March 29, 2024): 63-hour Baltic interference event affecting more than 1,600 aircraft
7. Rohrbach, "How GNSS Jamming and Spoofing Affect Aerial Surveys": EASA Safety Information Bulletin revision 4 (July 2026), the GPSJam crowdsourced interference map, and Finnish National Land Survey interference counts (about 1,200 notifications in 2024 against 239 in 2023)
8. Langer, M. et al., "GNSS Spoofing Modeling and Consistency-Check-Based Spoofing Mitigation with Android Raw Data," Electronics (2025): targeted spoofing model from Android raw pseudoranges with iterative consistency-check mitigation, tested across bus, walk, ferry, car, flight, and bike scenarios
9. Olsson, G.K. and Nilsson, S., "Using Mobile Phones for Participatory Detection and Localization of a GNSS Jammer" (2023): crowdsourced C/N0 measurements from phones locate a jammer with a median error of 50 meters
10. Gattis, B., Gattis, E., and Akos, D., "Safeguarding Critical Infrastructure: Nationwide GNSS Protection via Smartphone Crowdsourcing," 2026 Joint Navigation Conference (ION): smartphone crowdsourcing to detect, characterize, and locate jammers and spoofers nationwide, building on the J911 concept
11. Lo, S., Chen, Y.H., Akos, D., Cotts, B., and Miralles, D., "Tests of Crowdsourced Smartphones Measurements to Detect GNSS Spoofing and Other Disruptions," Proceedings of ION ITM 2019, Stanford GPS Laboratory: crowdsourced smartphone detection of spoofing using position, acceleration, AGC, C/N0, and pseudorange comparisons, including a live over-the-air spoofing test
12. European Commission, "How Galileo OSNMA helps counter GNSS spoofing" (September 8, 2025): OSNMA Initial Service declared July 24, 2025, the first civil GNSS authentication service; strict mode requires time synchronization within plus or minus 30 seconds; no other GNSS offers open authentication for civil users
13. u-blox, "Galileo OSNMA, the new message authentication feature": OSNMA moved from test to operational status July 24, 2025; Galileo is the first and so far the only GNSS constellation to offer authentication to civilian users
14. GNSS-SDR Project, "Signal Model" documentation: GPS L1 C/A arrives at the Earth's surface at -158.5 dBW (-128.5 dBm), well below the noise floor
15. LITF-PA-2026-060: fleet GNSS receivers as a distributed sensor network for atmospheric measurement
16. LITF-PA-2026-151: consumer software-defined radio sensing; HackRF One costs about $350 and tunes 1 MHz to 6 GHz
17. 35 U.S.C. § 102(a)(1): prior art; printed publications available to the public before the filing date

Limitations

Nothing in this disclosure has been validated against a real spoofing attack. The fusion weights, the channel thresholds, the 100-millisecond synchronization requirement, the 1-kilometer cell size, and the five-minute return-to-trust rule are engineering estimates stated so they can be tested. No spoofer has been detected or localized with this system, and the table in section 5 is a worked example, not a result.

Four limitations bound what this system can do. First, urban multipath is the main false-positive source. A phone in a street canyon sees reflected signals that produce pseudorange residuals, cross-source disagreement, and constellation divergence for entirely innocent reasons. The double-difference test and the corroboration rule exist to separate multipath from spoofing, and they help, but multipath is correlated between nearby receivers in a way that partially defeats the double-difference cancellation, so the system's false-alarm rate in dense cities is the open question that decides whether it is usable. Second, a lone device is weakly protected. Without a neighbor, the double-difference score defaults to neutral and the total score caps below Confirmed, which means the first phone into a spoofed area gets a warning and not a verdict. Third, the system assumes a single-transmitter attacker. A sophisticated attacker fielding one transmitter per victim, each generating signals consistent with that victim's true position, defeats the double-difference test, and the defense then rests on the C/N0, clock, and OSNMA channels alone. Fourth, the system depends on adoption. It needs an operating system vendor or a fleet operator to ship it, and a crowdsourced network with no crowd is a specification, not a sensor.

The double-difference test carries its own noise-floor limitation, and it is stated here rather than buried. At phone grade, raw pseudorange noise of 1 to 3 meters per receiver would leave double-difference residuals of 1.4 to 4.2 meters even under perfect common-mode cancellation, which overlaps the authentic range and would make the test useless. The test depends on carrier-phase smoothing to cut the code noise roughly tenfold, and on differential multipath staying small under the strong counterfeit signal. If smoothing is unavailable, for example on a receiver that does not expose carrier phase, or if differential multipath in a dense city keeps spoofed residuals above 1 meter, the separation narrows and the double-difference score degrades toward a weak signal. The worked example assumes smoothing is available and multipath is moderate. Where it is not, the system must say so by capping the double-difference weight, not by trusting the score anyway.

The authenticated fallback has a matching limitation. OSNMA authenticates the content of the navigation message, not the ranging code, so a replayed authentic signal with a delay, a meaconing attack, passes authentication, and a secure-code-estimation-and-replay attack can in principle do the same. The OSNMA fallback is the most trustworthy satellite fix available during an attack, not a guarantee, and a spoofer sophisticated enough to replay authentic signals defeats it. That attacker is rarer and more expensive than the one this system is built for, but the limitation is real and the fallback keeps its cross-source checks running for exactly that reason.

The strongest case against this approach is that signal authentication will make it obsolete. Galileo OSNMA is already operational, GPS is developing its Chimera authentication service, and controlled reception pattern antennas keep getting cheaper. In twenty years, the argument goes, every receiver will authenticate its signals and spoofing will be a solved problem, so a crowdsourced detection network is a bridge to nowhere. The case has real force for aviation, where receivers are replaced on a decade cycle and authentication is becoming a certification requirement. It has far less force for the billions of receivers already deployed: the phones, cars, ships, tractors, survey instruments, and timing modules that will never receive an authentication upgrade, and that will keep trusting unauthenticated signals for the rest of their service lives. The transition to authenticated GNSS will take a decade or more, and the spoofing is happening now, at 1,500 flights a day at peak. A detection network that works on the hardware already in the field is the defense the installed base has today. Where the system is unsure, it must say Watch, not Confirmed, and where it has no corroboration at all, it must say nothing and let the lone phone warn its own user.