In June 2012, Todd Humphreys, an assistant professor at the University of Texas at Austin, stood in the New Mexico desert at White Sands Missile Range and watched a small helicopter drone drift out of the sky on command, steered not by its pilot but by a suitcase-sized device his team had built. The drone thought it was hovering in place. The GPS receiver on board was receiving beautifully clean satellite signals, exactly the kind it had been designed to trust. The signals were fake, broadcast from a spoofer about half a mile away, and the drone was quietly obeying a phantom sky. Officials from the Department of Homeland Security had invited the team to try it.
The demonstration ended a comfortable assumption inside the US government that civilian GPS was, if not exactly secure, at least too fiddly to hijack in the real world. Humphreys would later testify to Congress about the implications.
The dare
The Federal Aviation Administration was, at the time, drafting the rules that would eventually let commercial drones into American airspace. Someone at DHS wanted to know how bad the GPS problem might get once the sky filled up with unmanned aircraft relying on satellite navigation to stay where they were told. DHS had opened White Sands to universities and other civilian groups to test techniques for addressing civil GPS vulnerabilities, and Humphreys’ Radionavigation Laboratory — which had already published papers describing how a spoofer might work in theory — proposed to commandeer a civilian drone by spoofing it. DHS agreed, on the condition that the university supply all the manpower and equipment, including the target aircraft: a Hornet Mini rotorcraft, a roughly $80,000 machine of the kind used by law enforcement, not a toy. Before the test of record in New Mexico, the team ran a dry run back home in Austin, on the field of the university’s own Darrell K. Royal–Texas Memorial Stadium.
Spoofing is not jamming. A jammer drowns a GPS receiver in noise until it gives up and reports no fix at all, which is loud, obvious, and easy to detect. Spoofing is quieter. A spoofer transmits counterfeit versions of the same signals the real satellites are broadcasting from roughly 20,000 kilometres overhead, timed and shaped to slide underneath the authentic ones. The receiver, which has no way of telling the difference, locks onto the stronger local signal and begins computing a position based on lies.
What the box actually did
The device Humphreys’ team built ran on software-defined radio, a general-purpose signal generator that can be programmed to imitate almost any radio protocol. Civilian GPS signals, the ones used by every phone and car navigation unit on Earth, are unencrypted and their structure is published openly so that manufacturers can build receivers cheaply. Military GPS uses an encrypted signal called P(Y) code that is much harder to fake. The drone at White Sands, like nearly every commercial drone flying today, was listening only to the civilian channel.
The spoofer first matched the position the drone’s receiver was already computing, so the transition was invisible. Then, gently, the team began nudging the counterfeit signals a few metres at a time. The drone’s autopilot, believing it was drifting off station, corrected in the opposite direction. Push the fake position up, the drone flies down to compensate. Push it sideways, the drone banks the other way. To an onlooker it looked like the operators were flying it by remote. They were flying it by imagination.
Why this shook people at the FAA
Humphreys testified before Congress in July 2012, weeks after the demonstration. The record of that hearing is still one of the clearest public statements of what civilian GPS actually is: a fragile utility, designed in the 1970s for a world in which nobody had a software radio in their garage, now underpinning aviation, shipping, banking timestamps, power-grid synchronisation, and the location services on roughly six billion phones. The Baltimore Sun laid out the scale of the exposure in a piece on how deeply GPS is threaded into daily life, from ambulance dispatch to ATM transactions.
The frightening part of Humphreys’ demonstration was not that a government-funded lab could do it. The frightening part was the parts list. A software-defined radio board, an antenna, a laptop, some open-source code, and a few weeks of graduate-student effort. Everything on the bench was commercially available. The knowledge required was a few semesters of signal processing.
From a dare to a decade of incidents
The White Sands demonstration was staged. What followed in the real world was not. Humphreys’ group later repeated the trick at sea, spoofing a superyacht in the Mediterranean into steering hundreds of metres off course while the ship’s instruments continued to report a clean straight line. Ships in the Black Sea began reporting mass GPS anomalies near Russian coastlines, with dozens of vessels showing up on their own displays as parked at inland airports. Aircraft over the eastern Mediterranean started losing navigation as they crossed certain corridors. Forbes reported in 2024 that spoofing had begun leading commercial airliners off course in European airspace, with the source of the interference traced to Russian jamming and spoofing systems.
The military implications arrived on their own timeline. Drones and precision munitions in Ukraine have been losing their fix or being pushed off target with such regularity that the US Air Force has committed $49.7 million to alternative navigation programs, according to reporting on battlefield GPS failures. Weapons that cost six figures apiece are being defeated by transmitters that cost the price of a used car.
The quantum answer
Because the underlying weakness is physical — a signal travelling 20,000 kilometres arrives at your receiver so faint that anything louder wins — the long-term fixes do not try to armour GPS. They try to replace it. DARPA has been funding research into inertial navigation systems built from clouds of ultracold atoms, which can measure acceleration and rotation with such precision that a vehicle can, in principle, keep track of where it is for hours or days with no outside reference at all. Forbes covered the agency’s work with an Australian firm to build quantum navigation hardware as a GPS backup, aimed at platforms that cannot afford to be spoofed.
Quantum inertial units are still bench instruments in most cases — big, cold, power-hungry, and expensive. Shrinking one to fit inside a cruise missile or an autonomous car is the engineering problem of the decade. In the meantime, receivers are being retrofitted with plausibility checks that flag sudden position jumps, and some aircraft now cross-check GPS against onboard inertial units and terrain databases.
What Humphreys actually proved
The White Sands demonstration did not invent spoofing. Military researchers had understood the theory for decades, and the Russian and Chinese programs that now blanket entire regions with counterfeit signals were already under development. What Humphreys proved, on camera, was that the barrier to entry had collapsed. A graduate student with a modest budget could steer a flying vehicle out of the sky using a device small enough to fit in the trunk of a car. Anything a graduate student can do, a determined adversary can do more easily.
The policy response has been slow and piecemeal. Congress has passed narrow authorities for federal agencies to shoot down or disable rogue drones near sensitive sites, most recently expanded under the SAFER SKIES Act framework that hands limited counter-drone tools to state and local police. A separate raft of bills moving through Congress would tighten how critical infrastructure is protected, including against drones, as catalogued in recent coverage of pending tech bills. None of it fixes the underlying signal.
The suitcase is still on the bench
The device Humphreys built in 2012 is a museum piece now, technically. The components are cheaper, the software is faster, and any competent radio hobbyist can assemble something more capable in a weekend. What has changed is the ambient level of paranoia. Airline pilots flying near the Baltic now expect their instruments to lie occasionally. Container ships crossing the Strait of Hormuz keep a paper chart handy. The FAA’s rulebook for commercial drones assumes, quietly, that any craft in the sky may at some point be flying by counterfeit stars.
The desert was quiet that afternoon in New Mexico. The drone was no toy — it was a professional-grade rotorcraft of the kind law enforcement flies. The suitcase-sized rig beside it was a proof of concept built by a professor and his students. The system it fooled — the constellation of roughly 31 satellites, some 20,000 kilometres up, broadcasting the timing signals that hold modern civilisation loosely together — has not been meaningfully changed since. It is still listening for the same signals, still trusting whichever one comes in loudest, still telling everyone below exactly where they are, or where someone with a radio wants them to think they are.
