GPS spoofing attacks to civil aviation infrastructure is one of the most advanced and little-known threats to aeronautical safety. India being one of the world’s fastest-growing civil aviation markets and a country with geopolitically sensitive airspace, is increasingly exposed to such threats.
GPS spoofing is the intentional transmission of fake Global Navigation Satellite System (GNSS) signals which deceives a receiver into calculating an incorrect position, velocity or time. This has progressed from a vulnerability to a real threat across the globe. While GPS jamming simply prevents the navigation signal from being received, spoofing is a more complex attack in which the spoofed signal sends falsified navigation data, which may cause the aircraft to fly off course and the instrument system to show what appears to be normal parameters. One of the most significant risks of spoofing is that the counterfeit signal may initially be treated by the receiver as authentic, making the interference more difficult to detect.
The threat is real and imminent for India, since the middle of 2023, and growing in volume as 2024 progressed, various Indian airlines, such as IndiGo, Air India and Air India Express, reported instances of GPS spoofing and interference in or near airspace adjacent to Pakistan, Afghanistan and the Middle East, which has historically been the domain of electronic warfare activity. The Directorate General of Civil Aviation (DGCA) welcomed these reports in safety circulars and the issue was given due significance in the aviation regulatory fraternities.
1. Understanding GPS Spoofing: Technical Foundations for Legal Analysis
GPS operates through a constellation of satellites broadcasting low-powered radio frequency signals to receivers on the ground and in the air. Spoofing devices, either based on the ground, mounted in vehicles or flown in a drone, broadcast on the same L1/L2 frequency bands (1575.42 MHz and 1227.60 MHz) but with increased signal strength to jam out the true satellite signal. The spoof signal mimics the shape of a genuine GPS signal, but carries bogus, fake location or time information. Within the aviation industry, this could lead to the acceptance of incorrect waypoints by the Flight Management System (FMS) of an aircraft, trigger false alerts in TCAS (Traffic Collision Avoidance System), misalign autopilot systems and corrupt ATM (Air Traffic Management) timestamps.
2. The International Legal Architecture
India, being a contracting state of a number of fundamental international civil aviation security documents, has considerable obligations under international law with respect to civil aviation security.
- The Convention on International Civil Aviation, 1944 (Chicago Convention): The Chicago Convention lays the basis for the sovereign jurisdiction over national airspace as per Article 1 and requires states to do what is necessary to ensure the safety and regularity of air navigation. ICAO Annex 10, titled “Aeronautical Telecommunications”, contains Standards and Recommended Practices (SARPs) relating to radio navigation aids, including GNSS The Convention does not expressly regulate GPS spoofing as a standalone offence, but its broader framework, together with applicable ICAO SARPs, provides the international basis for States to protect the safety and integrity of air navigation. The Convention does not expressly regulate GPS spoofing as a standalone offence, but its broader framework, together with applicable ICAO SARPs, provides the international basis for States to protect the safety and integrity of air navigation. The Convention does not expressly regulate GPS spoofing as a standalone offence, but its broader framework, together with applicable ICAO SARPs, provides the international basis for States to protect the safety and integrity of air navigation.
- The Convention for the Suppression of Unlawful Acts against the Safety of Civil Aviation, 1971 (Montreal Convention): Article 1(1)(e) of the Convention criminalises the communication of information which the person knows to be false and thereby endangers the safety of an aircraft in flight. This provision is very clearly within the scope of GPS spoofing. India has ratified this Convention and the Convention is implemented at the domestic level by enactment of implementing legislation. The Beijing Convention and the Protocol of 2010 incorporated new categories of aviation safety crimes involving the use of GNSS systems as attack tools, in response to the changing threat environment.
- ICAO’s role: The International Civil Aviation Organisation (ICAO) has released a series of notices and working papers dedicated to the subject of GNSS interference and spoofing, such as Circular 330 and several State Letters warning of GNSS spoofing activity in airspace close to conflict. These communications have been conveyed to DGCA, and India’s regulatory advisories have been based on them.
3. Domestic Legal Framework
- The Bharatiya Vayuyan Adhiniyam, 2024 and Aircraft Rules, 1937
The Bharatiya Vayuyan Adhiniyam, 2024 is now the principal legislation governing civil aviation in India and provides the Central Government with wide powers to make rules relating to the safety of aircraft and air navigation. The Act also contemplates regulation of communication, navigation and surveillance/air traffic management facilities and measures to safeguard civil aviation against unlawful interference. The Aircraft Rules, 1937 continue to provide the detailed regulatory framework to the extent they remain in force. Although these provisions provide a basis for regulating interference with aviation systems, they do not specifically address the technical and evidentiary challenges posed by modern GNSS spoofing attacks. The existing statutory framework also does not provide a dedicated offence specifically addressing GNSS spoofing against civil aircraft, leaving questions of appropriate classification, punishment and attribution to be addressed through multiple legal provisions. - Indian Wireless Telegraphy Act, 1933
The Indian Wireless Telegraphy Act, 1933 may provide an additional legal basis where spoofing equipment constitutes wireless telegraphy apparatus requiring authorisation and is used without the requisite licence. Wireless telegraphy apparatus may not be possessed or used without a licence, except as provided in section 3 of this Act. The use of an unauthorised device to transmit radio-frequency signals on protected aviation bands may therefore attract liability under the applicable wireless-telegraphy framework. Penalties are contained in Section 6 (the fine and imprisonment). The statute, however, provides a maximum of up to two years imprisonment and a fine which is completely inadequate for an act which can endanger hundreds of lives. - The Information Technology Act, 2000
Section 66F of Information Technology Act 2000 relating to cyber terrorism is arguably the most powerful legislation to fight GPS spoofing. Section 66F refers to life imprisonment for those who deny access to authorized users of computer resources or contaminate a computer network with the aim to threaten the unity, integrity, security or sovereignty of India or strike terror in people. Under this provision, a civil aviation security incident that is designed to cause harm would potentially be considered cyber terrorism if they are the result of a deliberate spoofing attack that would affect modern aircraft avionics and/or GPS receivers.Section 43 also imposes civil liability for unauthorised access and damage to computer systems. The scope of the IT Act to apply to airborne avionics systems and the fact that the attacks originated from foreign soil are, however, still subject to debate and test in Indian courts.
- The Bharatiya Nyaya Sanhita, 2023
The Bharatiya Nyaya Sanhita, 2023 (BNS) replaces the Indian Penal Code, 1860, and will come into effect on 1st July 2024, has provisions in relation to GPS spoofing in the chapter relating to acts endangering lives and the chapter relating to mischief. According to Section 125 of BNS (Section 336 of IPC), making an action to endanger the life or the personal safety of another person is a criminal act and Section 127 of BNS (Section 338 of IPC) shows that grievous hurt caused by endangering life is a criminal act. BNS Sections 105 and 109 (Culpable homicide and abetment) may be used if the act of spoofing causes harm to a person or death.
4. The Regulatory Response: DGCA’s Role
DGCA, the civil aviation regulatory authority under the Aircraft Act has been the most active institutionalist who has responded to GPS spoofing in India. Working through Civil Aviation Requirements (CARs) under CAR Section 5 – Air Safety. DGCA has issued safety alerts to the operators, requesting the operators to improve training for flight crew on the recognition of GNSS interference, to require operators to implement contingency navigation procedures and to cross-check with inertial reference system, and to require that incident reporting to ATC and DGCA be reported in the event of detection of GPS anomalies.
The regulatory instruments issued by the DGCA, however, have a remedial and operational nature and have obligations for the operators and crew, but do not contain any prosecutorial powers over the operators and the individuals or state actors who launch attacks.
5. Areas of Critical Gaps and Challenges
In India, there are several structural flaws which make it difficult to effectively fight against GPS spoofing. Identifying the source of the spoofing, that is, a significant evidentiary problem. State sponsored spoofing, as is common to regions with conflict on the border of India, poses a particular difficulty in attributing it with the level of proof necessary for the successful prosecution of a criminal case. India does not presently have a single, dedicated statutory framework specifically addressing cybersecurity risks to civil aviation systems, including GNSS spoofing. The aviation sector is not covered by a designated framework, as with the United States, where the FAA Reauthorization Act and the Aviation Cyber Initiative provide for the aviation sector. The broad provisions of IT Act, not specifically designed for avionics, form the backbone of India’s aeronautics cyber security.
Another legal aspect of the territorial dimension is that it is also sensitive. But when the crime occurs outside Indian territory, domestic criminal jurisdiction is limited, and mutual legal assistance treaties (MLAT) are a painfully slow and politically restricted process.
6. Way Forward: Legislative and Policy Recommendations
There is an urgent need to develop a more aviation-specific cybersecurity framework, including through appropriate rules, regulations and guidance under the Bharatiya Vayuyan Adhiniyam, 2024. Such a framework should clearly distinguish between GNSS spoofing and jamming, establish appropriate reporting and investigation mechanisms, and provide for proportionate enforcement measures consistent with India’s international obligations. Specifics on protection of Critical Infrastructure in the aviation sector need to be included in the National Cyber Security Policy and the upcoming Digital India Act.
Where GNSS interference is credibly attributable to conduct involving another State, India could consider appropriate diplomatic and ICAO mechanisms, including referral of relevant Convention-related matters to the ICAO Council and, where the requirements are satisfied, the dispute-settlement mechanism under Article 84 of the Chicago Convention.
Conclusion
GPS spoofing is no isolated incident against civil aircraft. It is a purposeful action that can undoubtedly endanger hundreds of lives and could be considered as a crime against civil aviation safety under the international law in existence. Existing laws in India provide for statutory action in various places in the Bharatiya Vayuyan Adhiniyam, 2024, the IT Act 2000, the Indian Wireless Telegraphy Act 1933, and the BNS, but they remain distributed across different legal frameworks and do not specifically address the attribution, investigation and prosecution challenges arising from GNSS spoofing. Given the incredible growth pathway of the Indian aviation industry and the complicated geopolitical situation surrounding Indian airspace, a unified, strong and aviation-specific cyber security law is not only desirable, but a matter of national security.
The immediate objective should not be limited to deciding how to punish those responsible after an incident occurs. The more important question is whether India has the legal and institutional mechanisms necessary to detect, attribute, prevent and respond to GNSS interference before it compromises the safety of an aircraft and the lives of those on board.
That is where the next phase of India’s aviation-security framework should focus.
Author: Jyotsna Chaturvedi, Head – corporate Practice and Shyamli Shukla, Senior Associate
Co- Author: Riyasha Anand, Intern
