What DP Operations Should Take From ICAO's GNSS Jamming Stance

The signal from the conference floor

The recent GPS World report on the 2026 World Overflight Risk Conference carried a clear message from ICAO’s Secretary-General: emerging military technologies – armed and surveillance drones, missiles, and deliberate GNSS jamming – now belong among the standing risks to civil aviation rather than the exceptional ones. ICAO urged states to act.

The framing is what matters to us. Aviation has stopped treating GNSS interference as a rare anomaly to be waited out and started treating it as a chronic operating condition to be managed by architecture and procedure. That is a regulatory and engineering posture, not a press line. Offshore dynamic positioning depends on the same satellite signals, faces the same threat actors in many of the same waters, and has not yet built an equivalent framework around the problem. The aviation playbook is worth reading closely, because the gaps it exposes on the marine side are specific and fixable.

What an aviation-grade PNT framework actually demands

Stripped to its load-bearing parts, aviation’s response to GNSS interference rests on four pillars. Each has a maritime analogue, and in our assessment each analogue is less mature.

Mandatory occurrence reporting feeding a shared data picture. Radio-frequency interference events are reported by crews and air traffic services and aggregated by bodies such as EASA and EUROCONTROL. The result is a continuously updated map of where interference is occurring, how strong it is, and how it behaves. The data drives the risk assessment rather than anecdote.

Hazard advisories pushed to the cockpit before the flight. The NOTAM and conflict-zone information machinery exists to put threat information in front of crews as a routine planning input. A flight crew planning a route through a contested region expects to be told that GNSS is degraded there.

Independent navigation means and defined holdover. Civil aviation never relied on GNSS alone. VOR, DME, ILS and onboard inertial systems remain in service precisely so that loss of satellite signals degrades capability rather than removing position knowledge. The work on Alternative PNT continues from that base.

Risk management embedded in a formal safety management system. Under ICAO Annex 19, GNSS interference is handled as an identified hazard with assessed likelihood, consequence and mitigation, not as a surprise. Signal authentication sits alongside this – Galileo’s Open Service Navigation Message Authentication (OSNMA) provides message-level authentication, and military signal protection (e.g. encrypted M-code/PRS) addresses deception at the signal level – together covering the layers Annex 10 governs.

The maritime side has pieces of all four. The IMO’s MSC.1/Circ.1575 guidance on shipborne PNT data processing recognises the need to detect and manage bad position data. IALA has pushed resilient PNT through R-Mode and eLoran work. IMCA has issued guidance and safety alerts on GNSS vulnerability. What we do not have is these pieces assembled into a coherent, enforced framework the way ICAO has assembled aviation’s.

Where this lands on the DP desk

For a DP vessel, GNSS interference splits into two failure modes with very different signatures, and conflating them is where operational thinking goes wrong.

Jamming is denial. The receiver loses lock, the position reference drops out, and the DP control system sees the loss directly. This is unpleasant but honest. The DP system de-weights or rejects the failed reference, the operator gets an alarm, and the vessel runs on whatever references remain. The risk here is one of margin: if too many references share the GNSS dependency, simultaneous loss can leave the controller with insufficient position information to hold station, and the consequence is a drift-off.

Spoofing is deception, and it is the one that should keep DP superintendents awake. A spoofed signal does not announce itself. It delivers a plausible, internally consistent position that is wrong, and it can pull that position slowly. The DP Kalman filter accepts it, the reference reports good quality figures, and the controller commands the thrusters to counter a drift that is not real. The vessel physically moves off station while the screen shows it holding. For close work – over a wellhead, alongside a structure, in proximity to other assets – that is a direct path to contact before anyone trusts the alarm over the display.

The failure that turns spoofing from a single-sensor fault into a system fault is common-mode. DP reference voting and median testing assume that references fail independently. If two or three of the position references are GNSS-based – different receivers, perhaps different correction services from providers such as those delivering L-band augmentation – they share the same vulnerability. A spoofing source that captures the antenna captures all of them together. The voting logic then sees a consistent majority and may reject a sound hydroacoustic or relative reference as the outlier. The redundancy that the DP class notation promises has quietly collapsed to a single point.

The correction link deserves its own attention. DGNSS and PPP services rely on a correction stream delivered over satellite L-band or a communications channel. That stream is part of the position solution’s integrity chain. Loss or corruption of corrections degrades the geodetic reference even when the ranging signals themselves look healthy, and the receiver’s reported accuracy figure does not always make that distinction obvious to the DPO.

The gaps the maritime side keeps tripping over

1. Counting boxes instead of counting principles

Class requirements and IMCA guidance call for multiple independent position references on higher-class DP vessels, and the intent – set out in IMCA M 103 – is independence of principle, not merely independence of part number. Industry practice still drifts toward fitting several GNSS-based references because they are cheap, accurate and easy to integrate. Three GNSS units exposed to the same antenna environment are one failure mode wearing three hats. The discipline that matters is ensuring at least one reference works on an entirely different physical principle: hydroacoustic USBL or LBL, taut wire, or a relative system such as a laser or radar reference to a fixed structure.

2. Trusting the quality figure

DPOs are trained to watch reference quality and weighting. Against jamming that works, because denial shows up as degraded or lost quality. Against spoofing it can fail completely – a well-formed spoof produces strong signal-to-noise and a confident position estimate. The quality figure is a measure of internal consistency, not of truth. Crews and procedures that treat a green quality indicator as proof of correct position have no defence against deception.

3. No shared interference picture

A vessel approaching a region of known GNSS interference has no marine equivalent of the NOTAM waiting in the passage plan. Reports of jamming at sea are scattered, often delayed, and rarely fed back to other operators in a usable form. Aviation built its advantage here by making reporting routine and aggregation central. The marine industry largely relies on individual operators noticing a problem and, sometimes, raising a safety flash after the fact.

4. FMEA that tests denial but not deception

DP FMEA work under IMCA M 166, and the proving exercises in annual trials under IMCA M 190, routinely test loss of a position reference. They less often test a reference that keeps reporting but lies. A spoofing scenario – a slow, consistent position pull injected into the GNSS-based references while acoustic and relative systems hold true – exercises the voting logic, the operator response and the abort decision in a way that simple dropout never does. Most fleets have not closed this gap because the test is harder to stage and the failure has historically been treated as exotic. ICAO’s stance is that it is no longer exotic.

What to put in place now

We would treat GNSS interference as a named hazard in the vessel’s safety case and work it through to specific, testable controls rather than awareness briefings.

Keep at least one non-GNSS reference live during every critical activity. For dynamic operations near a structure or seabed asset, run a hydroacoustic (USBL/LBL) or relative reference (laser or radar to a fixed target) as a continuous independent check on the GNSS solution, not as a standby. Set the DP system to alarm when the spread between GNSS-based and non-GNSS references exceeds a defined threshold tied to the operation’s position-keeping tolerance.
Add GNSS jamming and spoofing to the ASOG. Under the IMCA M 220 / MTS Activity Specific Operating Guidelines, define green/yellow/red thresholds for interference indicators – receiver AGC and C/N0 anomalies, reference spread, correction-link status – and pre-agree the response at each level, including the point at which GNSS references are manually de-weighted or removed from the model.
Specify receivers that fight back. Procure multi-constellation, multi-frequency receivers with RAIM and interference detection, and enable Galileo OSNMA where the hardware supports it so that navigation-message authentication gives a real signal-level check against spoofing. Where threat exposure justifies it, specify a controlled-reception-pattern antenna to reject jamming from low elevation angles.
Quantify INS holdover against your DP footprint. Where inertial aiding is fitted, establish the drift rate on total GNSS loss and confirm the holdover time keeps the vessel inside its operating footprint long enough to transition to remaining references or execute a controlled abort. If the numbers do not support the planned operation, that is a design finding, not a tuning detail.
Test deception in FMEA and trials. Extend the DP FMEA under IMCA M 166 to cover a coordinated spoof of all GNSS-based references, and inject a slow position pull during annual trials under IMCA M 190 to verify that voting, alarms and operator response behave as intended. Record the time from injection to operator action – that interval is your real margin.
Report and share interference, every time. Log AGC and C/N0 records and reference behaviour for any suspected event, report to the relevant national authority and through IMCA channels, and feed the data into your own fleet’s planning. The marine industry will only get an interference picture worth having if operators stop treating each event as a private nuisance.

The lesson from the conference floor is not that aviation has solved this. It is that aviation has decided to manage it as a permanent feature of the operating environment, with architecture, reporting and authentication doing the work. Offshore DP runs on the same fragile signal in the same contested waters. The frameworks already on our shelves – IMCA M 103, M 166, M 190 and M 220, IMO MSC.1/Circ.1575, IALA’s resilient PNT work – are enough to build the same discipline. What is missing is the decision to use them against deception, not just denial.

Based on: ICAO urges action on drones, missiles and GNSS jamming threats to civil aviation