Executive Summary
The Secure World Foundation's 2026 counterspace assessment confirms that GNSS jamming and PNT interference are mature, widely held capabilities. For offshore survey and DP operations, the failure mode is not loss of signal alone but corruption of an apparently healthy position solution. We dissect where the positioning chain breaks, why standard quality control misses spoofing, and the specific architecture and procedural changes that bound the risk against IMCA, IOGP and IHO S-44 expectations.
A counterspace report that belongs on the survey desk
The Secure World Foundation has released the 2026 edition of Global Counterspace Capabilities: An Open Source Assessment. The report compiles and evaluates publicly available information on counterspace capabilities under development across 13 countries, grouped into five categories: co-orbital, direct-ascent, electronic warfare, directed energy and cyber. Jamming against GNSS and the wider position, navigation and timing (PNT) infrastructure features prominently in the assessment, as reported by GPS World.
We read documents like this through one lens: what does the threat profile do to the positioning chain that an offshore survey or construction vessel depends on. The headline finding for our discipline is not new physics. It is the confirmation that deliberate L-band interference is no longer an exotic, state-level edge case. It is a fielded, proliferating capability that survey managers now have to treat as a credible operating condition in contested or congested waters, not a once-in-a-career anomaly.
This is a failure analysis rather than a threat briefing. The interesting question is not whether GNSS can be denied. It can. The question is how that denial or corruption propagates through a modern integrated positioning architecture, where the existing safeguards stop working, and what a defensible resilience case looks like.
The single point of failure hiding in an integrated stack
Most offshore positioning architectures have quietly become more dependent on GNSS over the last fifteen years, not less, even as they have grown more sophisticated. The dependency is structural and it is easy to lose sight of.
Start with the surface chain. A primary GNSS receiver, usually multi-constellation and multi-frequency, feeds a correction service over L-band or satellite comms to deliver PPP or RTK-grade solutions. That position aids an inertial navigation system through a tightly or loosely coupled Kalman filter. The blended solution drives the vessel reference frame, from which lever-arm offsets propagate to every sensor: multibeam transducer, magnetometer, the USBL transceiver pole. For subsea work, USBL geo-references the beacon position by combining the acoustic range and bearing with the vessel’s GNSS position and heading. The surface fix is the datum the seabed inherits.
Now add timing. GNSS does not only provide coordinates; it disciplines the clocks that time-tag sonar pings, motion data and navigation strings. A one-pulse-per-second reference keeps multibeam, sound-velocity and attitude streams aligned. Corrupt the time and you corrupt the spatial registration of the swath even if the horizontal position looks correct.
Two distinct failure modes follow, and they are not symmetric.
Jamming raises the noise floor across the L-band. The carrier-to-noise density ratio collapses, the receiver loses lock, and the automatic gain control climbs as it tries to compensate. The honest outcome is loss of position: the RTK solution drops to float, then to autonomous, then to nothing. This is disruptive but visible. Alarms fire, position uncertainty grows, and trained crews respond.
Spoofing is the dangerous one. A counterfeit signal set is broadcast that the receiver tracks as genuine, computing a false position, false velocity or false time. The solution can carry every hallmark of health: a strong C/N0, a full constellation, a valid RTK fix flag, low HDOP. The vessel believes it knows where it is. It does not. For survey work this is the corrupting failure, because it does not announce itself.
Why spoofing slips past the quality control we trust
The detection gap is the heart of this failure mode. The quality indicators that survey and DP teams have relied on for two decades were designed to catch geometry and signal degradation, not deception.
Consider the integrated INS. The Kalman filter is built to trust GNSS aiding and to weight it heavily because, under normal conditions, it is the most accurate absolute reference available. A gradual spoof, one that walks the apparent position off true at a few centimetres per second, produces small filter innovations. The residuals stay inside the gates. The blended solution slowly follows the lie, and the INS, instead of catching the error, lends it credibility by smoothing it. A sudden position jump would be rejected. A slow drag is absorbed.
USBL inherits the problem directly. The acoustic measurement of range and bearing to the beacon may be perfectly correct, but the geo-referenced output is anchored to the spoofed surface position. The seabed target moves on the chart by exactly the surface error, and nothing in the acoustic data flags it because the acoustics are working as designed.
Survey QC at the processing stage offers partial cover at best. Crossline checks under IHO S-44 are run against other lines acquired in the same session, often through the same corrupted positioning. If the spoof is consistent across the survey, the internal agreement looks acceptable while the entire block sits off its true coordinates. Total horizontal uncertainty computed from the navigation solution reflects the receiver’s confidence in a position that is wrong. The statistic is healthy; the data fails the standard without anyone seeing it.
The uncomfortable conclusion is that under spoofing, the conventional acceptance metrics can all read green while the deliverable breaches its specification. A failure that does not trip an alarm is the failure that ends up in the final dataset.
What this costs beyond the DP alert panel
The DP community has absorbed the loss-of-reference case reasonably well, because IMCA guidance on the design and operation of DP vessels and the FMEA discipline force operators to think about reference redundancy and the consequences of losing a sensor. A jamming event that drops GNSS is, in DP terms, a known degraded mode with a defined response.
The survey and construction consequences of corruption run wider and are harder to recover.
A spoofed survey block delivered to a client carries a positional bias that may only surface when the data is overlaid against an independent dataset, a prior campaign, or as-built records during construction. By then the vessel has demobilised. Pipeline tie-in metrology, structure installation, drill-centre positioning and dredging acceptance all depend on absolute coordinates being true, not merely internally consistent. An undetected positioning bias propagates into engineering decisions, and the cost of discovering it late is measured in rework, standby and disputed acceptance, not in a few hours of lost line.
There is also a timing dimension that rarely gets attention until it bites. A spoofed or denied time reference desynchronises multibeam from motion and sound-velocity inputs. The bathymetry can show artefacts that look like sensor faults, sending teams chasing the wrong root cause while the real problem is upstream in the PNT chain.
The transferable lesson is that GNSS interference is a data-integrity failure first and a navigation failure second. Treating it solely as a DP availability problem misses where most of the value is actually exposed.
Hardening the positioning architecture
Resilience here is not a single product purchase. It is architecture, monitoring and procedure working together so that no single deception captures the whole solution. The following are the measures we would expect to see in a defensible plan for operations in contested or interference-prone waters.
Run genuinely independent references of differing principle. For DP, established IMCA guidance already pushes toward reference diversity. Apply the same logic to the survey solution: maintain at least one position reference whose physics is not GNSS. A hydroacoustic reference, taut wire or laser-based system gives you a source a GNSS spoof cannot touch. The test is simple – if one technology is compromised, the others must still resolve the vessel.
Make subsea positioning independent of the surface fix where it matters. For metrology and critical placement, specify an LBL array of at least four seabed transponders. Once the array is calibrated by box-in, LBL holds the subsea frame without reference to surface GNSS. That breaks the chain that lets a spoofed surface position propagate to the seabed deliverable.
Bound INS coasting and know your numbers. A navigation-grade INS coasting unaided drifts on the order of a nautical mile per hour; a lower grade drifts far faster. Pair the INS with DVL bottom-track when within altitude to constrain horizontal drift, and define an explicit coasting time budget in the procedure: how long the solution stays within survey tolerance after GNSS is removed. That number, not a vague reassurance, is the basis for a continue-or-stop decision.
Instrument the threat, do not infer it. Log and trend AGC, C/N0 per satellite and the L-band noise floor in real time, with alarm thresholds rather than post-hoc review. A climbing AGC and falling C/N0 across all satellites is the jamming signature; anomalous signal power and direction-of-arrival inconsistency point to spoofing. Controlled-reception-pattern antennas and receivers with built-in interference and spoofing detection flags should be specified for high-risk areas, and those flags must be wired into the watch alarms, not buried in a diagnostics menu.
Cross-check independent solutions automatically. The single most useful spoofing defence is a real-time divergence monitor between the GNSS-derived position and an independent estimate from INS coasting or acoustics. Set the divergence alarm at a fraction of the survey tolerance for the relevant IHO S-44 order, so a slow walk-off trips an alert long before it corrupts the deliverable. Manual eyeballing of two screens does not count as a monitor.
Protect the clock. Fit a disciplined oscillator – OCXO at minimum, chip-scale atomic clock holdover for extended denial – so that loss or spoofing of GNSS time does not immediately desynchronise time-tagging. Define how long time integrity holds before sensor alignment degrades beyond acceptance.
Build interference into the planning and the FMEA. Assess interference risk for the operating area at the tender and mobilisation stages, drawing on the kind of open-source threat picture the SWF report represents. Write GNSS denial and corruption into the ASOG along the lines of IMCA M 220, with defined yellow and red transitions, named fallback references and a clear stop case. Crews should drill the loss-of-GNSS and suspected-spoofing responses the way they drill drive-off and drift-off.
Specify the receiver and correction strategy deliberately. Use multi-constellation, multi-frequency receivers and favour correction services with authentication where available. Consult the joint IMCA/IOGP guidance on GNSS positioning in the offshore industry when setting the specification, and require the contractor to state how the proposed system detects and reports interference rather than only how it performs under clean-sky conditions.
None of this eliminates the threat. The SWF assessment makes plain that the capability to deny and deceive GNSS is broadly held and improving. What these measures do is remove the single points of failure, convert silent corruption into a flagged event, and give the survey team the independent evidence needed to decide whether the data on the disk can be trusted. That decision, made on evidence rather than on a green status light, is the deliverable that matters.
Based on: SWF: GNSS interference a key issue for space security
