Maritime Cyber Threat Briefing #5
What if your ship’s position is wrong and your navigation systems have no way of telling you?
That question is no longer a theoretical exercise for maritime risk professionals. It is the operational reality facing bridge crews transiting the Persian Gulf, the Strait of Hormuz, the Baltic Sea, and an expanding list of the world’s most commercially critical waters right now.
Satellite navigation has been treated for decades as a utility always available, inherently reliable, and trustworthy as the primary reference for position, course, and collision avoidance. That assumption has been broken. Electronic warfare, once confined to military operations in contested airspace, has migrated into the civilian maritime environment at a scale and with a persistence that the industry was not prepared to manage. The consequence is a fundamental crisis of navigational trust.
Section 1 – The Shift to Electronic Warfare
Modern electronic warfare in the maritime domain operates through two primary mechanisms, often deployed simultaneously.
- Jamming overpowers the weak signals transmitted by Global Navigation Satellite System satellites [GPS, Galileo, GLONASS & BeiDou] using ground-based or vessel-mounted transmitters broadcasting stronger signals on the same frequencies. The receiver aboard a vessel loses lock on the satellite constellation. The navigation system ceases to display a valid position. The crew knows something is wrong.
- Spoofing is the more dangerous and more insidious technique. Rather than blocking the signal, spoofing replaces it. Counterfeit satellite signals carefully crafted to mimic legitimate GNSS transmissions, are broadcast to receivers in the target area. Receivers aboard commercial ships compute incorrect positions while crews believe navigation systems remain fully functional. The chart shows the vessel somewhere it is not. The crew has no immediate reason to doubt it. The system is lying, silently and convincingly.
The characteristic sign of GPS spoofing in the maritime domain is the “ship-on-land” aberration, the vessel’s GPS sensor picks up the spoofed position and feeds it to the AIS transceiver on the bridge, which then retransmits it, broadcasting to the world that the ship Jamming Disrupts — Spoofing Deceivesis wherever the spoofing signal says it is.
The downstream consequences extend far beyond the vessel itself. Port authorities, vessel traffic services, charterers, insurers, and compliance teams all rely on AIS-derived position data. When that data is corrupted at source, the contamination cascades through every downstream system that treats satellite position as authoritative.
Section 2 – The Real Incidents: Two Active Electronic Warfare Environments
The Persian Gulf and Strait of Hormuz – 2025 to present
Electronic interference affecting commercial shipping in the Gulf predates the current conflict, but the the escalation of the Iran conflict on “February 28, 2026” [Operation Epic Fury], produced the largest documented GPS jamming event in maritime history.
Within 24 hours of the opening military strikes, more than 1,100 vessels experienced GPS and AIS interference across the Middle East Gulf. Ships were falsely positioned at airports, a nuclear power plant, and on Iranian land, creating navigation and compliance risks simultaneously. Windward identified at least 21 new AIS jamming clusters across the UAE, Qatari, Omani, and Iranian waters.
By March 7, that figure had risen to more than 1,650 vessels experiencing GPS and AIS interference. A 55% increase in under two weeks with at least 30 jamming clusters identified across Saudi Arabia, Kuwait, the UAE, Qatar, Oman, and Iran. Including signal displacement patterns evolving from circular crop-circle formations into zig-zag distortions throwing vessels’ AIS positions across multiple locations within a single 24-hour period.
The consequences have been immediate and severe. An estimated 20,000 seafarers were reported stranded west of the Strait, navigating in an environment shaped by electronic interference, operational paralysis, and the continuing threat of drone and missile attack.
In June 2025, during the earlier Israel-Iran escalation, electronic interference in the region coincided with the collision between the tankers Adalynn and Front Eagle off the UAE coast. While the UAE’s preliminary finding pointed to navigational error, analysts also identified significant GNSS/AIS interference in the area, reinforcing the safety risks created by operating in an active electronic warfare environment.
The strategic intent behind the Gulf interference is assessed as deliberate. Analysis of the spoofing patterns indicates that the interference is directed specifically to affect surface ships and concentrated near the Strait of Hormuz, suggesting intent to snarl traffic through the waterway, for which Iran has a clear strategic motive. By making the Strait digitally impassable, Tehran can disrupt the flow of approximately 21 million barrels of oil per day while maintaining a degree of deniability.
The Baltic Sea – Russia’s Persistent Electronic Warfare Campaign
While the Gulf generates the most immediate headlines, the Baltic Sea has been subject to sustained, daily electronic warfare affecting commercial shipping for over three years.
In 2025, Sweden’s transport regulator reported 733 GNSS disruption cases in the Baltic region, up from 495 in 2024 and 55 in 2023, underscoring the rapid escalation of interference affecting regional navigation and transport safety. Thirteen EU member states reported near-daily instances of signal jamming and spoofing, with Estonia estimating that 85% of its flights experience navigation disruptions.
Research conducted by GPSPATRON and Gdynia Maritime University aboard a research vessel in Baltic waters identified a distributed, multi-node interference system operating across multiple frequency bands simultaneously, jamming GPS, Galileo, and GLONASS signals while spoofing GPS. It prevented receivers from performing any constellation cross-checks and forcing navigation systems to rely solely on the forged position solution. Every interference event across the study period turned on and off at the same time, pointing unmistakably to centrally coordinated electronic warfare.
Estonia, Lithuania, Latvia, Sweden, and Germany have all formally declared the GNSS interference over the Baltic as a form of Russian hybrid warfare, a deliberate act with the intent to cause disruption, described by the Estonian foreign minister as “a hybrid action to disrupt our lives and to break all kinds of international agreements.”
In January 2026, fourteen coastal states of the Baltic and North Sea [including the UK, Germany, France, Poland, and the Nordic nations] issued a joint declaration explicitly placing blame on the Russian Federation and calling on the international community to train mariners to operate safely without GNSS. The declaration called for the international community to cooperate on the development of alternative terrestrial radionavigation systems capable of operating independently of satellite signals in the event of disruption or interference.
Section 3 – How It Works: The Technical Reality
Understanding the mechanism of GPS spoofing helps bridge teams recognise the warning signs before a compromised position leads to a dangerous situation.
GNSS satellites orbit at approximately 20,000 kilometres above Earth, transmitting extremely weak signals. Jamming is achieved by overpowering those weak signals with stronger radio signals broadcast from closer to Earth, a technically straightforward operation that requires relatively modest equipment.
Spoofing is more sophisticated. Real-world interference systems typically spoof GPS, the primary navigation constellation while simultaneously jamming all other GNSS signals. This prevents the receiver from performing any constellation cross-checks and forces it to rely solely on the forged GPS solution.
The spoofed position is then injected into every downstream system that draws from the GNSS receiver ECDIS chart displays, AIS transponders, voyage data recorders, autopilot systems, and any shore-based monitoring platform receiving the vessel’s position broadcast. The corruption is systemic, not isolated to a single instrument.
In April 2024, 117 vessels simultaneously appeared at Beirut Airport due to falsified GNSS signals, one of the earliest large-scale demonstrations of fleet-level AIS contamination through coordinated spoofing. By June 2025, Windward documented over 3,000 disrupted vessels in the Persian Gulf and Strait of Hormuz within less than two weeks. The scale of the problem has accelerated dramatically.
In practice, GNSS spoofing becomes an AIS problem almost immediately, because false position data is rebroadcast downstream through the vessel’s AIS transponder and then consumed by port systems, compliance tools, and counterparties as if it were true.
Section 4 – Operational Consequences
The operational impact of electronic warfare on commercial shipping is multidimensional, safety, commercial, compliance, and financial consequences interact and compound.
- Safety. Senior maritime intelligence analysts have warned that the most feared outcome is a scenario where a vessel abandons ship and their emergency broadcast position information is wrong due to jamming and spoofing. Potentially delaying or misdirecting rescue operations with fatal consequences. Navigation systems displaying false positions in congested or constrained waters create direct collision and grounding risk. The June 2025 UAE tanker collision is the documented precedent.
- Commercial disruption. Traffic through the Strait of Hormuz, which handles roughly 20% of global oil and gas exports, has ground to near paralysis, with vessels being attacked and insurers withdrawing maritime coverage. Energy prices have spiked, Asia and Africa face fuel shortages, and fertilizer costs have risen, threatening food security.
- Compliance exposure. Ships’ AIS signals diverted to Iranian land are triggering false positive risk and compliance breaches for banks, charterers, insurers, and other marine service providers with vessels appearing to have made port calls in sanctioned jurisdictions that never occurred. Post-voyage AIS track histories contaminated by spoofing will require explanation and verification long after the interference has ceased.
- Insurance. Several marine insurers, including Gard AS, Skuld, NorthStandard, The London P&I Club, and the American P&I Club, issued cancellation notices for war-risk cover in Iranian and adjacent Gulf waters as the conflict escalated. The insurance market has recognised what the electronic warfare environment represents a fundamental change in the risk profile of operating in affected waters.
Section 5 – The Human Factor: When Training Fails the Technology
The most under-discussed dimension of the electronic warfare threat to maritime navigation is the human one. Bridge crews have been trained for years, correctly to trust their digital navigation systems. ECDIS replaced paper charts. GPS replaced celestial navigation and dead reckoning. The integrated bridge systems of modern vessels present a seamless, authoritative picture of the vessel’s position and environment.
Recurring themes from navigation incident investigations include inadequate system familiarity, insufficient chart symbol knowledge, and “most critically” over-reliance on electronic systems without proper cross-checking. Many incidents involve experienced mariners who lack specific competency in recognising system failure or manipulation despite years of traditional navigation experience.
Bridge teams need to regularly drill “loss-of-GNSS” scenarios, recognizing spoofing, switching fully to manual navigation, and using backup tools with confidence.
Good seamanship, not technology, is what carries ships safely through uncertainty.
The insidious aspect of GPS spoofing is that it produces no obvious alarm. The position display continues to show a value. The chart continues to update. The ECDIS continues to function. The crew has no immediate indication that the position being displayed is false. Detecting spoofing requires active cross-referencing with independent position sources, radar bearings, depth soundings, visual observations, and compass cross-checks combined with the situational awareness to recognize when a displayed position is inconsistent with what the crew can observe directly.
That skill set is eroding. An entire generation of bridge officers has trained primarily on integrated digital systems. The traditional navigation disciplines, celestial navigation, manual chart plotting, dead reckoning, compass bearing fixing: are increasingly treated as historical context rather than operational competencies. In the current electronic warfare environment, that erosion carries real safety consequences.
The danger is not just technology failure. It is the interaction between deceptive data and crews conditioned to trust integrated bridge systems by default.
Section 6 – What Operators Must Change
Operating in a GNSS-degraded environment requires a shift from reliance on a single trusted input to disciplined, multi-source navigation.
- Treat GPS as one input, not the ground truth. Bridge procedures must require active cross-verification of GNSS-derived position against radar, visual bearings, depth soundings, and gyrocompass at regular intervals. Not as an exceptional measure, but as standard watch-keeping practice.
- Recognize the indicators of spoofing. Bridge teams must be trained to identify the specific signals that indicate spoofing is occurring: sudden unexplained position jumps, vessel position displayed on land or at known interference cluster locations, inconsistency between GNSS position and radar-derived position, AIS displays showing impossible vessel movements, and ECDIS position that conflicts with visual observation.
- Conduct regular GNSS-degraded navigation drills. Regular drills and scenario-based exercises should make GNSS loss a well-practised, not theoretical, event — treating interference as a known risk within company frameworks with clear procedures for entering critical areas. Crews should demonstrate competency in manual navigation before they are required to exercise it under pressure.
- Restore traditional navigation competencies. Ship managers should assess whether their bridge officers can competently navigate using radar, visual bearings, and paper charts in the absence of functioning GNSS. Where those skills have atrophied, structured refresher training is required. Not as an optional enhancement but as a “safety-critical” capability.
- Update voyage risk assessments for electronic warfare. Pre-voyage assessments for transits through the Persian Gulf, Strait of Hormuz, Red Sea, Baltic Sea, and Black Sea must explicitly address GPS jamming and spoofing as anticipated conditions. With specific bridge team briefings, agreed position verification intervals, and documented fallback procedures.
- Monitor AIS output for anomalies. Shore-based operations teams should cross-reference vessel-reported AIS positions against independent satellite imagery and radar data for vessels operating in known interference zones. A vessel appearing at an airport or inland location in AIS data is not a technical glitch to be dismissed. It is a confirmed spoofing indicator.
Regulatory Context
In March 2025, the International Maritime Organization, International Civil Aviation Organization, and International Telecommunication Union issued a rare joint statement addressing the security risks of GNSS disruption to aviation and maritime navigation. An extraordinary cross-agency intervention that underscores the recognized severity of the threat at the international level. The STCW [Standards of Training, Certification & Watchkeeping] Convention’s competency requirements for navigating officers include backup navigation and position verification procedures, though the adequacy of current training standards in preparing crews for active electronic warfare environments is increasingly questioned by maritime safety professionals. The “US MARAD Advisory 2026-001A” specifically designates the Strait of Hormuz, Persian Gulf, Gulf of Oman, and parts of the Arabian Sea as areas of active GPS interference requiring heightened navigational vigilance.
The renewed interest in terrestrial radio-navigation and non-GNSS backup positioning is a signal that governments now view satellite-only navigation dependence as a strategic vulnerability, not just a technical limitation.
The question is no longer whether navigation systems can be disrupted. In the Persian Gulf, they are being disrupted daily, at a scale affecting thousands of vessels simultaneously. In the Baltic Sea, they have been disrupted near-daily for three years. The electronic warfare capability that states have deployed against military targets has spilled, deliberately and irreversibly, into the civilian maritime environment.
Satellite navigation is not broken. But it can no longer be trusted unconditionally. The bridge that relies solely on GNSS-derived position in a contested electronic environment is not navigating with confidence. It is navigating on faith.
Operational resilience in the current threat environment requires a deliberate return to the principles that pre-date satellite navigation: independent verification, multi-source cross-referencing, trained crews who can navigate by skill when the technology fails them, and the professional discipline to question what the screen is showing.
The sea has always demanded respect for what cannot be seen. Electronic warfare has added a new invisible threat. One that does not announce itself, does not trigger an alarm, and does not give the crew a second chance if it goes undetected in constrained waters.
Preparing for Electronic Warfare is not optional. It is seamanship.
Maritime Cyber Threat Briefing is an independent series covering cyber threats, vulnerabilities, and risk management across the global maritime industry. It is published by Alexandros Engelen, a Cybersecurity Strategist, specializing in maritime cyber risk.
