Stay informed
Unpublished Opinions
How to Hack a Superyacht
The year the iPhone 3G came out, the one with the GPS chip installed and working Google Maps, Todd Humphreys spent a lot of time on the floor of his Bay Area apartment, surrounded by a jumble of wires and his three-year-old son Ramon. Humphreys had just moved with his family across the country to California to co-found a navigation startup based on GPS. (It was later acquired by Apple.) The startup job took up most of his time, but the reason for the wires on the beige carpet, plugged into a spread of laptops, switchboards, and radios, was pure curiosity. Humphreys and a college friend were trying to build something they believed had not yet been created outside of the military. They were building a spoofer.
A spoofer is, in a word, a fake. It co-opts a real GPS signal and replaces it with false information about where—and sometimes, at what time—the receiver is located. The “new” signal is far stronger, and when it meets the genuine signal, it takes over, bumping off the real signal like a wolf in sheep’s clothing. The trick here, like with any good act of forgery, is for the hijacking to be so seamless that the receiver never even realizes anything is wrong and so never raises the alarm. This is possible because, unlike the military signals, civilian GPS signals are not encrypted.
Spoofing is far more dangerous than jamming—blocking out the GPS signals until they are unusable—and it’s also far more complex. The risk of jamming was something the system’s architects understood from the very beginning of the GPS system, because the inherent weakness of the signals as they travel toward Earth means they can be drowned out by electromagnetic noise. But in 2008, as Humphreys was lying on his carpet in California, spoofing was still largely seen as a non-issue, especially outside conflict zones.
At the time, the conventional thinking was that spoofing “was generally considered too hard for the layman to do, and it would only be like a nation-state type thing,” says Sherman Lo, a senior research engineer at Stanford’s GPS Lab. “And if that happened, then the generally held opinion was that we have bigger problems.”
The spoofing idea came from a copy of GPS World published the previous year, in July 2007. Flipping through the magazine, Humphreys stumbled on a column written by Logan Scott, a consultant who got his start in the GPS world working on receivers for Texas Instruments. Scott was arguing that when it came to mass spoofing, it was only a matter of time.
Maybe someone wanted to illegally overfish, adding tens of thousands of dollars to their crab or shrimp catch, by covering up their tracks. Or maybe they’d like to dump some toxic waste or other hazardous material. The incentives were there—and so was the technology. Even in 2007, Scott argued that a credible spoofer could be developed for less than $10,000 using off-the-shelf parts. Once spoofing started at scale, it would also be inherently difficult to stop, he pointed out.
Scott had already begun working on a system to “authenticate” civil GPS signals while raising the alarm, despite what he says was the consistent refrain from the United States government that spoofing would be too hard for civilians to carry out. But the response to his proposal was that signal authentication was not needed, he says. This was when he started thinking of his efforts as “Project Cassandra,” after the Trojan princess from Greek mythology who was cursed to make accurate prophecies that no one would believe.
By the time Humphreys had finished reading the column, he recognized the inherent challenge it contained. He would build a spoofer and prove Scott right. One year later, on his carpet in California, his “Dr Frankenstein moment” finally arrived.
“What I then saw in that little blue dot was the potential for chaos.”
That evening, Humphreys decided the spoofing equipment was at last ready to be tested. He picked up his iPhone and opened up Google Maps. There he was, a tiny blue dot, positioned serenely on the grid of his residential neighbourhood.
Then he turned on the rogue fake signal from his spoofer and watched as the dot on the screen appeared to race off down his street, heading north.
“What I then saw in that little blue dot,” he later said, “was the potential for chaos.”
GPS had become seamlessly enmeshed into almost all areas of everyday life, and the arrival of the iPhone had only sent that dependence into the stratosphere. It had produced, for much of the Western world, a relationship with GPS based on an instinctive, even intimate, level of trust. This trust had, in turn, opened up an alarming vulnerability.
“We’re almost blindly reliant on it,” Humphreys said. “It’s built deeply into our systems and infrastructure. Some call it ‘the invisible utility.’”
In the 2000s, there was still a clear difference between the worlds of civilian and military signals, even if both types were now equally accurate. In the civilian world, the weakness of GPS signals was not seen as a vulnerability so much as an engineering challenge. In the military world, a new breed of “electronic warfare” was exploding in tandem with the digital revolution.
In the lead-up to the Iraq War in 2003, Richard Langley, a GPS expert at the University of New Brunswick, predicted that the US military might employ some spoofing, while the Iraqi military could do some jamming of their own using Russian equipment. The jammers were already affordable and easy to find if you knew where to look, he reported.
Once the war began, Langley’s predictions proved accurate. Russian-made GPS jammers began showing up on rooftops across Iraq, attempting to block the signals guiding the Americans’ GPS-guided missiles. The influence of Russian technology was telling. In the early 2000s, during his first years in office, President Vladimir Putin announced that one of his priorities was the full restoration of the Global Navigation Satellite System (GLONASS), a Soviet-era satellite navigation system, and he gave it a budget to match.
But GLONASS wasn’t the only system on the rise. In 2005, the European Space Agency launched the first Galileo test satellite. Three years earlier, in 2002, the Japanese government had authorized the creation of a regional satellite network, QZSS, while perhaps most notably of all, the Chinese had launched the first satellite in their own network—BeiDou—in 2000. (Global Navigation Satellite Systems, or GNSS, is the umbrella term that encapsulates all of the satellite navigation networks.) It was the dawn of a new kind of Space Age, with geopolitics once more playing out above the Earth’s atmosphere.
The year he spoofed his iPhone, Todd Humphreys gave a talk on his experiment at the Institute for Navigation annual conference, the annual brouhaha for the GPS and GNSS world, attended by civilians and governments alike. Logan Scott was in the audience that day, and after the session, he immediately approached Humphreys, beckoning him into the hall outside.
“Holy smokes, you actually built it,” Scott said.
“Well, I read your article,” Humphreys replied.
“If I can do this, lots of people can do this.”
Part of the reason to build the real-life spoofer was not just to show that it could be done, and by a civilian, but by what kind of civilian. If the bar was someone with a background in electrical engineering, a PhD in aerospace engineering, and a working knowledge of GNSS, that still left a small but notable pool of people who could pull it off, some of whom were in the room that day. It was enough, Humphreys was arguing, for the tools of spoofing to “escape state control.”
His message was, “If I can do this, lots of people can do this.”
By then, Humphreys had left the Bay Area and taken up a teaching position at the University of Texas at Austin, where he had founded his own lab focusing on radio navigation. The US Congress had recently voted to open domestic airspace to civilian drones within just a few years, and Humphreys was shocked that the message of how easy it was to manipulate GPS hadn’t really sunk in. So, he and his students devised another spoofing experiment.
The small team quickly acquired an $80,000 drone, which resembled a helicopter and was about the size of a small dog. They took the drone out to the Darrell K Royal–Texas Memorial Stadium in Austin. On June 14, 2012, they recorded a video of the drone hovering noisily above the field, with the crowd of researchers watching from the ground below. When the spoofer was turned on, the drone’s GPS indicated it was suddenly hurtling upward. This spurred the drone’s autopilot to “correct” its direction downward. In the video, the drone immediately starts to plummet toward the ground, until one of the students manually intervenes to prevent it from crashing onto the field.
The footage was later posted on the Fox News website, with a comment from Humphreys. “Spoofing a GPS receiver on a [drone] is just another way of hijacking a plane,” he argued.
In 2013, Elon Musk used his talk at the South by Southwest conference in Austin to announce that he’d like to die on Mars—just not on impact. But this isn’t the session that Andrew Schofield, captain of a superyacht called the White Rose of Drachs, remembers today.
Scanning the conference program, a seemingly minor session about “extreme” GPS, held in a downtown hotel meeting room, caught his eye. He used GPS every day on the yacht, and the session was the one thing on the program that seemed relevant to his day-to-day life. The speaker was Todd Humphreys, and the talk was a play-by-play account of his drone-spoofing experiments.
Mere minutes into the talk, Schofield’s jaw was on the floor. Suddenly, his trust in his equipment was gone. He’d been using a GPS receiver by then for about two decades—the whole marine industry were early adopters—and it had transformed his own work. But now he was flabbergasted. At the end of the presentation, he approached Humphreys with a proposal. “Would you like to do it at sea?” he asked.
Humphreys responded without missing a beat. “I’d love to do it at sea.”
Schofield had the blessing of the yacht’s owner, Michael Evans, a British real-estate magnate. Evans, who passed away in 2023, immediately saw the risk to the yachting industry’s safety equipment, Scofield says.
Schofield’s proposal for the experiment was carefully designed not to interfere with the yacht’s usual itinerary. The White Rose would be making a fully crewed trip that July from its mooring in the south of France to Turkey, where they would pick up Evans’s family for their summer holidays. Humphreys and a couple of graduate students could tag along for a one-way trip and wouldn’t be much trouble. Schofield insisted Humphreys bring along his flabbergasted wife.
Humphreys was not entirely convinced the whole thing was actually real, but it was too great an opportunity not to take the risk. So that July, he gave his brother all his passwords, just in case this was really a kidnapping on the high seas, and packed his bags.
Tucked into the aquamarine waters of the Côte d’Azur in the south of France, the Port de Cap d’Ail marina is tiny and exclusive—a fishbowl overlooked by the Tête de Chien, the rock formation that looms over tiny, neighbouring Monaco, located just a stone’s throw away. It’s a beautiful stretch of the Mediterranean by any standard, but on June 25, 2013, it was particularly lovely: a blazingly bright sky and turquoise sea framed by the luxury white condos looming over the marina, with temperatures climbing into the mid-20s.
On arrival, Humphreys and his two graduate students, looking slightly giddy, posed in front of their temporary laboratory: a sixty-five-metre, $80 million, blazingly white superyacht with the rose logo visible on the bridge, featuring staterooms named after famous painters, each containing a copy of their work.
The trip had been arranged so quickly there hadn’t been much time to prepare. Before the trip, however, Humphreys had looked up the legal restrictions on manipulating electromagnetic signals at sea.
Any kind of interference with the spectrum is strictly illegal in most countries, but they would be doing the spoofing on international waters, at low power and at a safe distance from other boats and land. (His previous experiments had been officially sanctioned or else, like the iPhone spoofing, so low-powered they were confined to Humphrey’s apartment.) The yacht’s navigational equipment was pretty “vanilla,” Schofield assured him, a representative sample of the sort of equipment used across the industry.
The White Rose steadily made its way east from Monaco and down to the Tuscan coast. There, in international waters near a picture-perfect island of medieval houses fronted by turquoise waters, Schofield made his announcement: it was time.
Jahshan Bhatti, one of the students, brought the spoofer to the top deck of the yacht and set up his equipment. The rest of the crew and engineers gathered in the cabin, crowding around the walkie-talkie.
The equipment Bhatti was using looked innocuous, just a silver block with a small, stubby antenna, not very different from a computer server, plugged into a power source and a laptop. He placed the spoofer on the smooth, white surface of the yacht’s upper deck and turned it on.
After a few minutes, Schofield called the upper desk via walkie-talkie. “Jahshan, go ahead and proceed with the spoofing,” he said.
While Bhatti was now spoofing the yacht’s autopilot, there was nothing obviously amiss. The yacht’s GPS tracker showed that it was going straight. There were no beeps, no alarms, nothing on the horizon to indicate that anything had changed at all. It was only when they turned around that they could see a slight bend in the yacht’s wake, subtle but noticeable. This had been the goal: little by little, the yacht would be led off course.
“The power of the siren call of this fragile, weak signal that ended up diverting an entire yacht.”
“I thought that was a beautiful sight in its own way,” Humphreys said, standing at the stern of the boat, the Mediterranean sun beating down from a perfect blue sky. “The power of the siren call of this fragile, weak signal that ended up diverting an entire yacht.”
The entire crew was staggered, no one more so than Schofield. As a young man, certain rules had been drilled into his training. Always look out of the window. Never blindly trust the equipment. As long as there was land nearby, you had a visual marker, and as long as you had a visual marker, you had radar. If there was a discrepancy between the charts and the radar, then you knew something was wrong. But a weakness always lingered even in this cautious approach, once the other clues were out of sight.
“At deep sea, you’re blind,” Schofield says.
Somewhere in the Aegean, the next test began. A large yacht is always moving from side to side—a couple of degrees left, a couple of degrees right—along the planned route, constantly swaying and correcting back toward the centre. To see a small degree of deflection on a compass is not enough to suggest a yacht is off course, Schofield says.
So, for this experiment, the engineers triggered a tiny error: just two purposeful degrees, enough to drive a tiny wedge between the real location and the false one, but not enough to look in any way unusual. Twenty minutes later, the yacht was already a mile off course. There was no alarm. The “health check” light on the GPS was green. There was no bend in the wake to indicate that something was off.
It was only when the engineers turned the spoofer off that the yacht’s on-screen location suddenly “jumped” to where the vessel really was, revealing just how far off course it had veered.
“Oh my goodness,” thought Schofield. “How can this be?”
For the captain of the White Rose, it was a watershed moment, the equivalent of the evening Humphreys watched his own blue dot take off down the block. The technology on which he had always relied could no longer be trusted, he concluded.
Meanwhile, the next question on everyone’s minds was obvious. If you could spoof a superyacht, triggering no alarm and leaving no bended wake, what would be next? The stunt quickly went viral around the world, but it was Todd Humphreys’s last live experiment. He had proven his point. In any case, spoofing had now completely moved out of the realm of the theoretical. When I asked, in 2024, if he’d ever considered conducting another spoofing experiment, Humphreys smiled pointedly.
“I don’t need to,” he said. “Vladimir’s doing all my experimentation for me.”
Excerpted, with permission, from Little Blue Dot: How GPS Shaped the Modern World by Katherine Dunn, published by Bloomsbury Publishing, 2026.
The post How to Hack a Superyacht first appeared on The Walrus.
Unpublished Newswire
Comments
Be the first to comment