GPS Spoofing, the Ghost Aircraft Appearing on ADS-B Displays Over the Eastern Mediterranean, and the Authentication Gap Nobody Built Into the System from the Start

GPS spoofing in the Eastern Mediterranean, Black Sea corridor, and Persian Gulf region is generating documented position errors exceeding 200 miles, placing aircraft on traffic displays far from their actual locations and triggering false pull-up warnings on commercial flights in level cruise. The vulnerability traces to an architectural decision made in the late 1990s and early 2000s: ADS-B was designed as an open, unauthenticated broadcast system, and the cryptographic fix that would have closed that gap was deferred - and never delivered.

What ADS-B Actually Does at the Signal Level

ADS-B stands for Automatic Dependent Surveillance-Broadcast. The word dependent is the key. The system depends entirely on the aircraft knowing its own position and reporting it. There is no ground station interrogating your aircraft. No radar confirming your location. Your transponder simply broadcasts continuously - on 1090 MHz for standard-equipped aircraft, and 978 MHz for UAT systems used in general aviation below 18,000 feet.

Every one to two seconds, that broadcast transmits your ICAO address, GPS-derived latitude and longitude, GPS-derived altitude, ground speed, and track. The message goes out in the clear - no encryption, no authentication code, no digital signature. Anyone with inexpensive hardware and knowledge of the published format can decode it.

This openness was intentional. Instead of building expensive interrogating radars at every coverage point, a receiver connects to the internet and provides surveillance over airspace that previously had none. The open model is what made the system economically viable and what enables direct aircraft-to-aircraft traffic awareness. The system works. Hundreds of thousands of aircraft use it every day. But the openness was always a tradeoff.

GPS Jamming vs. GPS Spoofing: Why the Distinction Matters

These two attacks cause fundamentally different problems in the cockpit.

GPS jamming floods the frequency band GPS uses with noise. Your receiver can’t hear the satellites. Avionics flag the degradation. You get a GPS fail annunciation. It’s disruptive, but it’s detectable - the aircraft knows something is wrong.

GPS spoofing is entirely different. A spoofing transmitter doesn’t block the GPS signal. It transmits a false signal that looks, to your receiver, exactly like a legitimate satellite signal - same structure, same modulation, same timing protocol. The receiver has no mechanism to distinguish the fake from the real.

The spoofer tells your GPS receiver you are somewhere you are not. Your FMS accepts that position. Your ADS-B transponder broadcasts it to the world as valid. Jamming is someone shouting over a conversation. Spoofing is someone replacing the conversation with a perfect forgery - and the system cannot tell the difference.

Where GPS Spoofing Is Active Right Now

EUROCONTROL, the European Organization for the Safety of Air Navigation, has been tracking GPS interference incidents and publishing safety notices with substantially increasing report density in certain corridors since 2022.

The most heavily documented regions fall into three areas:

Eastern Mediterranean: airspace near Cyprus, Israel, Lebanon, Syria, Jordan, and into northern Iraq
Black Sea and Kaliningrad corridor: affecting aircraft transiting between Scandinavia, Finland, and Turkey
Persian Gulf region: clustering around Gulf airways and major airport approach corridors

These are not empty oceanic routes. Tel Aviv Ben Gurion Airport handles more than 20 million passengers per year. Beirut Rafic Hariri and Amman Queen Alia are served by every major international carrier. The airways feeding this region are among the highest-density international routes in the world.

Documented position errors range from a few miles to more than 200 miles from actual location - not 200 feet. Aircraft have received GPS-derived positions placing them over Cairo while tracking the planned route from Larnaca to Tel Aviv.

IFALPA, the International Federation of Air Line Pilots Associations, has been tracking these reports and issuing member advisories. Airlines operating through affected airspace now routinely include GPS interference summaries in crew dispatch packages. This is not a fringe problem - it is a standard operational consideration for crews flying into the region.

What a Spoofed Aircraft Looks Like on Your Traffic Display

When an aircraft is GPS spoofed, it continues operating normally in most respects. The crew may not initially know anything is wrong, particularly if the spoofing is subtle. The transponder keeps working. The problem is that the position field in every broadcast is wrong.

Every ADS-B In receiver within range - whether a ground station or another aircraft - sees a contact at the false position. Real tail number. Real transponder. Real squitter. False location.

TCAS II (Traffic Collision Avoidance System version 2) provides partial insulation here, but it creates its own inconsistency. TCAS II’s resolution advisory logic doesn’t rely on GPS at all - it uses transponder interrogation and round-trip signal timing to calculate range. So TCAS might show a spoofed aircraft at a plausible range based on signal timing, while ADS-B In shows that same aircraft at a position inconsistent with that range. Two data sources now disagree on the same contact. Some modern TCAS and ADS-B fusion implementations will flag that inconsistency. Many will not.

The Most Dangerous Outcome: False Terrain Alerts

The ghost contact on your traffic display is not the worst-case scenario. The worst case is a false EGPWS (Enhanced Ground Proximity Warning System) terrain alert.

EGPWS compares GPS-derived position against a terrain database in real time. If spoofing moves your indicated position to a location where terrain is above your current altitude, the system sees an imminent terrain conflict and fires: Pull up. Pull up.

Airlines operating in the Eastern Mediterranean have reported exactly this scenario - crews in level cruise over water receiving terrain warnings for mountains nowhere near the actual flight path. The correct response to a genuine EGPWS pull-up warning is an immediate climbing maneuver. You do not second-guess it. If the warning is false, an airliner just maneuvered based on fictional terrain.

That is not a nuisance alert. It is a material safety event.

The Authentication Gap That Was Never Closed

When the ADS-B protocol was being designed in the late 1990s and early 2000s, the engineers writing the standard knew the open broadcast model created an authentication problem. Technical papers from that era discussed cryptographic authentication for ADS-B. The concept was straightforward: each ADS-B message would include a digital signature - a cryptographic hash signed with a private key unique to that aircraft. Ground stations and receiving aircraft could verify the signature against a public key registry. A spoofed message, by definition, would carry no valid signature.

The same cryptographic approach secures web browsing and every online financial transaction. It works. It scales.

The problem was deployment. Managing a public key infrastructure (PKI) across the entire global aviation fleet - spanning jurisdictions, maintenance cycles, avionics manufacturers, and aviation authorities - while simultaneously pushing through an avionics mandate that airlines were already fighting on cost grounds, proved intractable.

The decision was made to defer authentication. The mandate went forward with the open broadcast model. Authentication would be addressed in a future standard.

That future has not arrived. What arrived instead was a geopolitical environment where state-level actors routinely deploy GPS spoofing infrastructure in airspace transited by commercial aircraft every hour of every day. The engineers who made that call were not negligent - the threat model was reasonable given the world as it existed in 2002. The world moved faster than the bet.

Where the Industry Stands on Closing the Gap

ACAS X (Airborne Collision Avoidance System generation 10) is the next-generation collision avoidance standard in development. Where TCAS II follows rigid encounter logic tables, ACAS X uses probabilistic modeling and can weigh inconsistent data sources differently - identifying when ADS-B position data and transponder-based ranging disagree significantly and discounting the ADS-B contribution to its threat assessment. ACAS X certification is ongoing. It is not yet deployed across most of the fleet.

In the near term, network-level consistency monitoring is being developed at the ground station layer. Stations receiving ADS-B from multiple aircraft simultaneously can look for geometric impossibilities - if an aircraft’s reported position is inconsistent with cross-checked independent data, the network flags that contact as suspect. It doesn’t prevent the spoofed broadcast, but it builds situational awareness at the air traffic management level.

Honeywell and Collins have pushed software updates tightening the cross-check between GPS position and inertial navigation on modern FMS platforms. The key principle: a legitimate GPS position update cannot move an aircraft 200 miles instantaneously. An inertial cross-check catches that. Some operators have lowered the divergence alert threshold in response to the spoofing environment.

RTCA (the Radio Technical Commission for Aeronautics) has active working groups on ADS-B authentication. The long-term solution remains cryptographic signing. The logistics problem hasn’t gone away, but the threat is now concrete enough that priority has shifted.

What This Means for General Aviation

For general aviation, the picture is more limited. A basic ADS-B Out installation using a single GPS source has no inertial cross-check. If the GPS gets spoofed, the transponder doesn’t know - the signal goes out with the false position, and there’s no onboard mechanism to catch it.

The practical fix for that aircraft is pilot awareness.

Practical Steps for Pilots in Affected Airspace

Know where the threat is active. EUROCONTROL GPS interference notices are publicly available. NOTAMs increasingly reference GPS unreliability in specific regions. Before flying into the Eastern Mediterranean, Black Sea corridor, or Gulf region, check current advisories. They exist, and they are regularly updated.

Know the symptoms. Watch for position errors, GPS fail or GPS degraded annunciations, discrepancies between GPS position and what dead reckoning would suggest given your last known position and elapsed time, and terrain warnings in level cruise with clear separation from any terrain.

Cross-check with ground-based navaids. DME (Distance Measuring Equipment) and VOR are terrestrial systems that cannot be spoofed by the same means as GPS. If your DME places you 30 miles from a navaid and your GPS says 50 miles from the same station, you have a GPS problem. Trust the DME.

Report it. A pilot report of GPS anomaly in the Eastern Mediterranean contributes to the dataset that EUROCONTROL and the FAA use to build the interference picture that drives safety notices to operators. Your report matters beyond your own flight.

If you receive an EGPWS terrain warning in conditions where terrain is not a factor, initiate the procedure and communicate with ATC. Establish a safe configuration first. Sort out the cause second.

ADS-B delivered on its core promise - the coverage, the traffic awareness, the surveillance over airspace that previously had none. The mandate was worth doing. What it didn’t solve was authentication, and what nobody fully predicted was that the world would move fast enough to turn a theoretical vulnerability into a daily operational reality before the fix arrived. Knowing the gap exists, knowing what the symptoms look like, and knowing how to cross-check puts you ahead of the crew that never got the briefing.

Key Takeaways

GPS spoofing in the Eastern Mediterranean, Black Sea corridor, and Persian Gulf has generated documented position errors exceeding 200 miles, creating ghost traffic contacts and triggering false EGPWS pull-up warnings on commercial aircraft.
Unlike GPS jamming, spoofing is invisible to the receiver - your avionics accept the false position and broadcast it as valid ADS-B data, with no onboard warning.
ADS-B was deliberately designed without authentication in the late 1990s–early 2000s; a cryptographic fix was proposed and deferred, and remains undeployed across the global fleet.
TCAS II’s resolution advisory logic is independent of GPS, providing partial protection, but inconsistencies between TCAS ranging and ADS-B position data may or may not be flagged depending on avionics.
In affected airspace, cross-check GPS against DME and VOR, monitor for spoofing symptoms, and file pilot reports - both for your own situational awareness and to contribute to the shared interference picture used by EUROCONTROL and the FAA.