How we got here

The civilian GPS program was initiated in 1973.

The original engineering team made a foundational call. Two signals would broadcast from each satellite. One for military use, one for civilian use. The military signal was encrypted and authenticated. The civilian signal was openly documented and published so anyone could build a receiver.

That openness was deliberate. It's the reason GPS became the global utility it is today. Every car, phone, and fitness watch that uses GPS does so because the signal is open.

It's also why civilian GPS is unauthenticated, unencrypted, and trivially spoofable.

GPS has added newer civilian signals over the decades (L2C, L5, L1C), but the security model hasn't changed. Civilian signals remain unauthenticated, and the spreading codes are public. Each satellite broadcasts a unique pattern that a receiver listens for to identify the satellite and measure distance. Because those patterns are published, anyone can generate them and transmit a signal that looks legitimate to a receiver.

A software-defined radio is a programmable radio transceiver. You can buy one online for a few hundred dollars. Combine it with open-source code on GitHub and you have a working spoofer for under a thousand dollars total.

This is not a nation-state attack. It's a weekend project for a motivated attacker.

The reason most security teams underestimate this attack is that legal experimentation is heavily restricted. Few people are allowed to actually test it, so the perceived difficulty is much higher than the real difficulty.

Worse, the legal regime cuts the wrong way. The law prohibits testing, but enforcement is light. Honest researchers self-censor while attackers operate unbothered. We've created an "on your honor" system that punishes the people we need on our side.

The pattern is well-established. Every time we discount an attacker's motives or underestimate their access to hardware, it ends badly.

What OSNMA actually solves

OSNMA stands for Open Service Navigation Message Authentication. It's Galileo's answer to the spoofing problem. It went operational July 24, 2025, and it's free for any receiver that supports it.

Here's the mental model.

When you log into your bank, you type a password. The bank checks the password and confirms your identity. OSNMA does the same thing for satellite signals. Each navigation message arrives with proof of identity that your receiver can verify. The signal stays publicly readable because it isn't encrypted. But now the receiver knows the message actually came from a Galileo satellite and not from an attacker on the ground.

Under the hood, OSNMA uses a protocol called TESLA. No relation to the car company. The satellite signs each navigation message with a secret key, then discloses that key a few seconds later. By the time the key is public, the receiver already has the message and signature buffered. Verification happens backward in time. It's clever, and it works for what it was designed to do.

OSNMA prevents an attacker from forging a fake navigation message and detects tampering with satellite position and clock data. That makes basic spoofing considerably harder.

But it leaves four gaps that matter for drones.

It does not stop jamming. The next generation of Galileo, called G2, will include jamming resistance. G2 deployment is now expected to begin in 2027, with twelve satellites planned in total. Full operational coverage is years away.

It only authenticates Galileo. GPS, GLONASS, and BeiDou are still wide open. Cross-authentication for GPS isn't planned until 2028 at the earliest.

There's a startup delay. The Time to First Authenticated Fix is roughly 100 seconds in ideal conditions. Urban environments stretch that to 127 to 266 seconds. For a drone, that's a problem on both ends of a flight. Before takeoff, you're either waiting on the pad or launching with an unauthenticated fix. If anything blocks your signal mid-flight, a building or a canyon, you fly without authenticated location until the receiver recovers. That's another 100 seconds of unauthenticated operation. In the air.

A low-cost attack defeats it. This is the one that changes the conversation. In January 2025, researchers published "Practical Spoofing Attacks on Galileo Open Service Navigation Message Authentication" (arXiv:2501.09246). They demonstrated four distinct attacks using two software-defined radios. Two of them, including a Concatenating Replay attack, were validated against a commercial Septentrio receiver. The TS-Comply Forgery attack, which forges navigation messages that pass authentication and would let an attacker spoof a drone to any location, was demonstrated against a software receiver because the signal-generation toolchain doesn't yet match commercial hardware. The attack is real, and two mid-range SDRs cost under $5,000, putting the gear in reach of a determined hobbyist.

Read that again. A forged Galileo signal passed authentication. Today on a software receiver, soon on commercial hardware once the signal toolchain catches up.

Where CHIMERA fits

GPS has its own answer in development. It's called CHIMERA, short for Chips-Message Robust Authentication.

CHIMERA is more ambitious than OSNMA. It authenticates both the message and the signal timing, which closes the gap the January 2025 research exposed.

The schedule is the issue.

CHIMERA is being tested on a satellite called NTS-3. It was originally planned to launch in 2022. It actually launched in August 2025, a three-year delay. Testing runs through 2026. After that, it has to be built into the next generation of GPS satellites and rolled out across the constellation.

A realistic operational date for CHIMERA on GPS is late 2020s to mid 2030s. Plan for the world we have today, not the one being designed.