Global navigation satellite systems underpin position, navigation and timing (PNT) across virtually every modern platform – and that dependence has made GNSS jamming and spoofing one of the fastest-growing threats in electronic warfare. Evaluating how real equipment holds up against those attacks requires a controlled way to generate them. This is exactly what the Spanish Naval Academy’s research centre set out to build – and our L-band helix antenna became the transmit element at the sharp end of it.

LOKI: a transportable GNSS jamming & spoofing system

The Centro Universitario de la Defensa at the Escuela Naval Militar (CUD-ENM) developed LOKI, a system able to run jamming and synchronous spoofing attacks across multiple GNSS bands and constellations, faithfully counterfeiting GPS position and time. Its purpose is defensive: to catalogue how resilient the receivers and dependent systems aboard Navy vessels really are.

Architecturally, LOKI is a transportable rack. Software written in Rust reads its scenario from a YAML file, pulls the live constellation geometry from a RINEX file, and synthesises a spoofed signal that reproduces propagation delay, Doppler and attenuation per satellite while cancelling the direct spoofer-to-victim path – updating the picture every 100 ms. Those samples feed an Ettus Research USRP N200 SDR, disciplined to GPS time by a GPSDO so the spoofing can be synchronous. The RF output then passes through an L1-band (1575 MHz) power amplifier and out to the antenna.

The transmit antenna: an L-band RHCP helix

The radiating element is our L-band helical antenna: right-hand circular polarisation (RHCP), a reinforced ground plane, roughly 15 dBi of directive gain, a relatively narrow beam and a very low back lobe. Two units were built and tuned to 1575.42 MHz (GPS L1), rated for 50 W CW. The RHCP match to the GPS signal, the directive-but-not-huge beam for pointing at a target from shore, and the weatherproof build are exactly what a field jamming/spoofing setup needs.

Field trials with the Spanish Navy

LOKI has taken part in the naval exercises NEMO-22, MARSEC-22/23/24 and MINEX-23/24 (plus GNEX-24), creating degraded-GNSS environments in which effective jamming and spoofing attacks were run against more than fifteen naval units and both own and coalition aircraft. Tellingly, some attacks affected not only the navigation receivers but other onboard systems that were never the direct target – which is precisely the kind of second-order vulnerability these trials exist to surface.

A concrete example: MINEX-24, Cabo Blanco (Mallorca)

In MINEX-24, LOKI was positioned near Cabo Blanco with the perturbation directed along a 135° bearing while a victim ship ran a zig-zag coastal approach on GPS. As the ship passed between two waypoints about 3 nautical miles offshore, a three-minute jamming burst forced its GPS receiver out of tracking and back into acquisition; a spoofing attack immediately followed, counterfeiting a predefined location. Seconds later the ship’s GPS was showing a route deviation that simply was not happening.

Why a helix

For this application the helix is a natural fit: its circular polarisation is inherently matched to the RHCP GPS signal, its directive pattern lets the operator point energy at a specific unit from a shore vantage point with little wasted in the back lobe, and the antenna is robust enough to live on a tripod in the field. The same antenna family is offered in different turn counts to trade beamwidth against gain, and each unit is tuned and measured before it ships.

Credit & references

All field photographs on this page show the LOKI system developed by CUD-ENM and are reproduced with their permission. The technical description above is drawn from the team’s public communication:

• J. M. Núñez-Ortuño and F. Troncoso-Pastoriza, “Jamming (Spoofing) System for Onboard GPS Receivers” (“Sistema de perturbación (spoofing) para receptores GPS embarcados”), XI National Congress on R&D in Defence and Security (DESEi+d 2024), Jaén, November 2024. calderón.cud.uvigo.es
• LOKI source code, CUD-ENM (Zenodo, restricted access): zenodo.org/records/18785690

Work carried out under project PICUD-2023-05 of the CUD-ENM, with the collaboration of the 1st Mine Countermeasures Squadron and INTA.