How to Detect GPS Spoofing Using Commercial Flight Data

Every commercial aircraft equipped with ADS-B Out broadcasts its GPS-derived position to the world. But embedded in that broadcast are two fields that most flight tracking enthusiasts never look at: NIC (Navigation Integrity Category) and NACp (Navigation Accuracy Category - Position). These values are the aircraft's self-assessment of how much it trusts its own GPS fix. When those values drop, it means the aircraft's navigation system is detecting a problem. And when multiple aircraft in the same geographic area simultaneously report low NIC/NACp values, you've found a GPS interference zone.

This technique has transformed commercial aviation from a transportation network into the world's largest distributed GPS monitoring system — thousands of aircraft acting as unwitting sensors, reporting the quality of the GPS signal wherever they fly.

Jamming vs. Spoofing: Two Different Threats

GPS jamming is brute force: a transmitter broadcasts noise on the GPS frequencies (L1 at 1575.42 MHz, L2 at 1227.60 MHz), overwhelming the weak satellite signals. The receiver knows it has a problem — it can't get a fix, or the fix is degraded. Modern aviation GPS receivers detect this and report it honestly through reduced NIC/NACp values. Jamming is easy to detect precisely because it's obvious to the receiver.

GPS spoofing is deception: a transmitter broadcasts fake GPS signals that mimic real satellites but carry false position or timing information. A naive receiver accepts the spoofed signals and computes a wrong position while believing the fix is good. This is far more dangerous because the receiver doesn't know it's being deceived.

However, modern aviation GPS receivers use RAIM (Receiver Autonomous Integrity Monitoring), which cross-checks signals from multiple satellites for consistency. When spoofing is imperfect — and it almost always is, because perfectly replicating the signals from 6+ satellites simultaneously is extraordinarily difficult — RAIM detects the inconsistency and degrades the reported integrity. This is why NIC/NACp values are useful for detecting spoofing as well as jamming.

Understanding NIC and NACp

NIC is defined in RTCA DO-260B and ranges from 0 to 11. It describes the containment radius within which the aircraft's true position lies with a probability of at least 99.999%. Higher NIC values mean tighter containment — more trustworthy position data.

• NIC 0: Unknown integrity. The system cannot bound its error. This is the red flag value.
• NIC 1-4: Containment radius of 20+ nautical miles down to 4 NM. Significantly degraded.
• NIC 5-7: Containment radius from 2 NM to 0.3 NM. Mildly degraded, possibly normal for some phases of flight.
• NIC 8-11: Containment radius below 0.2 NM. Normal operations with GNSS augmentation.

NACp follows a parallel scale for accuracy (as opposed to integrity). NACp 0 means accuracy is unknown; NACp 10-11 means sub-10-meter accuracy.

In normal operations, a GPS-equipped aircraft on an RNAV route will report NIC 8 or higher and NACp 9 or higher. When you see these values drop to NIC 0-3 or NACp 0-4, something is interfering with the navigation solution.

Crowdsourced Detection: Aircraft as Sensors

The power of this approach is scale. On any given day, approximately 45,000 commercial flights are airborne. Each one broadcasts its position and integrity values via ADS-B every half-second. Networks like the OpenSky Network, ADS-B Exchange, and adsb.lol aggregate these broadcasts from thousands of ground receivers worldwide, creating a global dataset of position reports with integrity metadata.

To detect GPS interference, you filter this firehose for aircraft reporting NIC below a threshold (typically NIC less than or equal to 6 for initial detection, NIC 0 for confirmed interference). Then you plot these reports on a map. The geographic clustering of low-NIC reports reveals the interference zone. The boundary of the cluster approximates the jammer or spoofer's coverage area.

Because aircraft are at altitude — 30,000-40,000 feet for en-route traffic — they can detect GPS interference from much farther away than a ground-based sensor. A jammer that might affect a 10km radius on the ground can be detected by aircraft 100+ km away, because the line-of-sight at altitude is unobstructed.

Geographic Hotspots

Eastern Mediterranean

The region around Cyprus, Lebanon, Israel, and Syria has been one of the most active GPS interference zones since 2018. Israeli electronic warfare systems create widespread spoofing that causes aircraft GPS receivers to report positions in Beirut when they are actually near Ben Gurion Airport, or positions at Cairo when over Tel Aviv. Flight tracking data consistently shows clusters of NIC 0 reports throughout this region, with intensity varying based on the security situation.

Baltic / Kaliningrad

Russia's Kaliningrad exclave, sandwiched between Poland and Lithuania, is home to electronic warfare units that regularly jam GPS across the eastern Baltic. Finnish, Estonian, and Polish aviation authorities have documented thousands of GPS interference events. The pattern is correlated with Russian military exercises: interference increases during exercise periods and subsides between them. Flight data shows NIC degradation across a wide area extending from Kaliningrad to the Finnish border.

Persian Gulf

The Strait of Hormuz and surrounding waters experience chronic GPS interference from Iranian electronic warfare systems. Aircraft approaching airports in the UAE, Oman, and Bahrain regularly report navigation anomalies. The interference has been severe enough to prompt ICAO (International Civil Aviation Organization) to issue advisories, and several airlines have modified approach procedures to reduce reliance on GPS in the region.

Conflict Zones

Active conflict zones — Ukraine, parts of Iraq and Syria, the Red Sea region during the Houthi campaign — show persistent GPS interference. Ukrainian forces and Russian forces both deploy GPS jamming extensively, creating a broad interference zone visible in flight data as aircraft reroute or report degraded navigation over much of the Black Sea region.

From Detection to Analysis

Detecting the interference zone is the first step. The analytical value comes from what the interference pattern reveals about the source.

Locating the source. By plotting the geographic distribution of low-NIC reports and their degradation values, you can triangulate the approximate source of a jammer. Reports closest to the source show the lowest NIC values; reports at the periphery show moderate degradation. The centroid of the lowest-NIC cluster approximates the jammer location.

Timing analysis. When does the interference start and stop? Correlation with known military exercise schedules, political events, or conflict escalation provides context. A jammer that operates on a regular schedule (weekdays only, specific hours) suggests training or testing. Continuous operation suggests operational deployment.

Coverage modeling. By collecting interference reports over time and overlaying terrain data, you can model the effective coverage area of a jammer. Mountains block line-of-sight to jammers; valleys create shadow zones. The pattern of affected and unaffected aircraft paths reveals the terrain interaction.

How Deep Seer Aggregates Confidence Data

In Deep Seer, we ingest flight data from the OpenSky Network with integrity fields included. Each aircraft position is stored with its NIC and NACp values. The system computes a rolling geographic heatmap of navigation confidence: areas where the average NIC value drops below a threshold are highlighted on the globe, giving analysts an immediate visual of where GPS interference is active.

This data layer can be combined with other feeds for richer analysis. Overlay maritime AIS data to see if ships in the same area are reporting position anomalies. Cross-reference with conflict event databases to correlate interference with military activity. Layer in NOTAM data to identify officially acknowledged interference zones versus unreported ones.

The result is a living map of the global GPS interference environment, built entirely from open data, updated in near real-time, and requiring no classified sources or specialized equipment. Every commercial aircraft is a sensor, and every ADS-B broadcast is a data point.

Ten thousand aircraft at 35,000 feet, each broadcasting the trustworthiness of their GPS fix twice per second — it's the largest distributed electronic warfare monitoring network ever built, and nobody designed it to be one.