GPS Spoofing, the False Positions Flooding the Baghdad Flight Information Region, and the ADS-B Integrity Assumption the Aviation System Has Never Fully Reckoned With

Aircraft transiting the Baghdad flight information region are broadcasting positions dozens of miles from where they actually are. The ADS-B system is functioning correctly. The GPS receivers feeding it are not - because they are locked onto deliberate false signals, not satellites. The surveillance picture controllers and pilots see is built on data that cannot verify its own accuracy.

How GPS Spoofing Works - and Why the System Can’t Tell

The GPS signal is unauthenticated. A receiver has no cryptographic mechanism to confirm that a signal arriving at its antenna actually originated from a satellite. It trusts the signal because it arrives at the correct frequency and carries the correct mathematical structure.

A ground-based transmitter powerful enough to override the satellite signal can broadcast that same structure with false timing and position data. The receiver locks onto it, computes a position from that false data, and reports it with full confidence. No warning flags. No anomaly alerts. Just a wrong position, delivered at full precision.

Researchers identified this vulnerability in the late 1980s. For decades it remained theoretical. Around 2022, it became operational.

The Baghdad FIR: How the Threat Became Documented

OPSGROUP, an international aviation safety intelligence organization that aggregates operational reports from airline and business aviation crews worldwide, began logging unusual reports from the Baghdad flight information region around 2022. Crews were reporting navigation systems computing positions that contradicted what their inertial reference systems showed. Discrepancies ranged from a few miles to large enough to trigger automated alerts and cause flight management systems to compute incorrect guidance.

By 2023, OPSGROUP was documenting thousands of GPS interference events per month across the Middle East and Eastern Europe. The Baghdad FIR remained the most heavily affected area. Routes over the eastern Mediterranean, approaches to Beirut, and segments over the northern Red Sea showed consistent interference. Eastern European routes near the Russian border - over Finland and the Baltic states - showed a related but distinct problem: jamming.

Jamming vs. Spoofing: Why the Distinction Matters

Jamming is brute-force interference. A jammer broadcasts radio frequency noise on GPS frequencies, overwhelming the satellite signal. The receiver cannot compute a position. The cockpit shows a GPS lost warning and the navigation system downgrades. It is operationally disruptive, but the system at least knows it is broken.

Spoofing is more dangerous because it is silent. The receiver shows no warning. It locks onto the false signal, computes a position, and reports high confidence. The flight management system accepts that position and begins using it for navigation. The pilot and controller have no immediate indication that anything is wrong.

In documented Baghdad FIR events, position displacement ranged from a few miles to more than 60 miles. In at least one reported case, an aircraft operating in the region received GPS data placing it over Iranian territory. The FMS began computing deviation guidance toward that false position.

GPS position feeds two systems: the navigation display and ADS-B Out. Whatever the GPS reports, the ADS-B system broadcasts over the radio. Every aircraft within line-of-sight range receives that broadcast - at cruise altitude, that range can exceed 200 miles. Ground stations relay it to air traffic control. The Aireon satellite constellation picks it up for oceanic and remote airspace controllers who have no radar coverage.

The surveillance picture for everyone in that airspace is built from those broadcasts.

A single aircraft with a spoofed GPS, cruising at FL350, will appear on every traffic display in range at a position it does not occupy. In radar-covered airspace, a controller may notice a mismatch between the primary radar return and the ADS-B data tag. In oceanic airspace, there is no primary radar. The controller is working solely from ADS-B. The separation picture they are looking at is not the sky that exists.

The Cross-Check That Protects Crews - and the Gap It Reveals

The crew that caught the Iranian territory false guidance did so by comparing the GPS-derived position to the inertial reference system output. Those two numbers did not agree.

Inertial reference systems do not use GPS. They use accelerometers and gyroscopes to dead-reckon position from a known starting point. They accumulate drift over time, which is why they are normally blended with GPS. But in the short term, an inertial reference system is immune to GPS spoofing. GPS spoofing displaces position suddenly. Inertial drift is slow and predictable. The divergence rate between the two systems tells the story.

Not every aircraft has a high-quality inertial reference system. Many general aviation aircraft and some regional turboprops rely almost entirely on GPS for navigation. That cross-check is not universally available - and it is not automatic on all aircraft that do have the capability.

What the Regulatory Response Has Looked Like

The FAA issued a Safety Alert for Operators addressing GPS interference in the Baghdad FIR, flagging the operational risk and recommending operators verify alternative navigation capability before routing through affected areas. EUROCONTROL published multiple safety advisories for European routes near conflict zones. ICAO has been working the problem through its airspace safety monitoring committees.

The operational intelligence infrastructure has grown significantly since 2022. Several business aviation flight departments now brief GPS interference status alongside NOTAMs and significant weather for Middle East and Eastern European operations. OPSGROUP maintains a real-time GPS interference map that operators can consult during route planning.

The Structural Problem ADS-B Was Never Designed to Solve

ADS-B was built on an assumption of GPS integrity - not that GPS would always be perfect, but that when a GPS receiver reported a high-confidence position, that position was genuine. The architecture has no layer of independent verification at the broadcast level. When a ground station receives an ADS-B broadcast, it has no mechanism to verify whether the position reflects where the aircraft actually is.

This is not a design failure in context. When the ADS-B architecture was taking shape in the 1990s, operational GPS spoofing at scale was a theoretical concern. The design priorities - coverage, cost, and interoperability across a global fleet - were appropriate to that threat environment. They are less appropriate now.

The Technical Fixes in Development

GPS III satellites, which the United States began launching in 2018, support Navigation Message Authentication - a digital signature embedded in the signal that lets a compliant receiver verify it is communicating with real satellites and not a ground-based transmitter. The European Galileo constellation has similar authentication capability built in.

But authentication at the signal level is only half the solution. Every receiver that wants to use it must be capable of processing the signature. The installed aviation receiver base spans every aircraft class from widebody jets to light sport. Updating that fleet requires certification cycles, avionics refreshes, and fleet replacement timelines measured in decades.

Advanced Receiver Autonomous Integrity Monitoring (ARAIM) takes a different approach that does not require signal authentication. It uses redundancy across multiple constellations - GPS, Galileo, GLONASS, and BeiDou - applying geometric analysis to detect anomalies. If one constellation’s signal looks inconsistent with the others, that is a flag. ARAIM is in the certification pipeline for certain approaches and navigation specifications, but deployment is still in progress.

Standard RAIM - receiver autonomous integrity monitoring already present in many avionics suites - checks the internal consistency of GPS satellite geometry. It was designed for the error profile of satellite failures and signal degradation, not deliberate false-signal injection. A sophisticated spoofing transmitter can present a geometrically consistent false solution that passes a standard RAIM check. RAIM is not a reliable defense against a capable threat.

What This Means for Pilots Now

For pilots flying domestically in the continental United States, the direct threat from military-grade spoofing of the Baghdad FIR type is low. These events are tied to specific conflict zone operations by actors with access to capable ground-based transmitters. Smaller-scale incidents have occurred near certain facilities and infrastructure, but nothing approaching the systemic coverage seen over the Middle East.

For operators routing through affected airspace, the operational guidance is procedural: consult the OPSGROUP interference map during route planning, verify alternative navigation capability is available, understand how the inertial reference system on your aircraft works and when to trust it over GPS, and maintain the discipline of not trusting a single data source when the stakes of that source being wrong are high.

Radar is difficult to spoof at scale because it is active - the return is independent of what the aircraft reports. ADS-B is passive. It reports what the aircraft broadcasts. And if the aircraft cannot trust what it is saying, neither can the system built to listen.

Key Takeaways

GPS spoofing in the Baghdad FIR has been actively documented since 2022, with thousands of interference events per month recorded by 2023; position errors have exceeded 60 miles in documented cases.
Because ADS-B Out draws directly from GPS, a spoofed aircraft broadcasts a false position to every aircraft and controller within range - in oceanic airspace with no radar, that false picture is all controllers have.
Comparing GPS position to inertial reference system output is the most reliable in-cockpit cross-check available; the two systems diverge at fundamentally different rates under spoofing conditions.
Signal-level fixes exist - GPS III Navigation Message Authentication and Galileo authentication - but updating the global installed receiver base is a decades-scale undertaking.
Standard RAIM does not reliably detect deliberate spoofing; ARAIM using multi-constellation cross-checking is more capable but not yet universally deployed.