By way of contrast, there are established approaches for good practice within the IT, cyber and software domains. These are well understood and used widely. Examples include: Cyber Essentials Good Practice12, ISO27001 framework for managing risk13, responsible disclosure principles for new threats14 and “white hat” PEN (penetration) testing15. Although there are some efforts to bring standard approaches16, and even “light” regulation forwards17, the reality is that PNT is less mature than cyber in these areas by a significant margin.

Because of the plethora of applications and requirements for position and time it is evident that there is no one-size-fits-all approach to deliver required resilience attributes.

Recent work on safety assurance for automated transport18 proposes, in essence, that consistent good practice across all sectors and domains is a good start, but that domain- specific approaches are a necessity to meet the needs of different sectors. A similar conceptual model is also applicable in the context of considering positioning and timing resilience.

An Uncomfortable Over-Reliance

For more than two decades satellite navigation systems have provided addictively accurate positioning and timing information that is free to use and can be scaled effortlessly to millions, or even billions, of user devices. Today there are more GPS receivers than there are people on the planet¹, with “receivers” adding less than a £1 to the build cost of high- volume devices.

This cocktail of amazing accuracy combined with extremely low cost has resulted in satellite-derived positioning, navigation, and timing (PNT) being almost universally adopted not only for convenience but also where factors such as safety, security or commercial considerations apply. This has led to a significant and growing dependence upon satellite- derived PNT that often is not fully understood in the systems and services we use in our everyday life.

Used with care, often with back-ups or augmentations in a so-called System-Of- Systems-Approach (SOSA), satellite-derived position and time can be invaluable, enabling synchronised and traceable timing, and accurate positioning. However, used naïvely or in an “unprotected” mode, there are risks to accuracy and trust of the information derived from satellite navigation systems. Coupled with growing dependencies, it can be argued that there is without doubt an uncomfortable over-reliance in many critical area².

The UK Government, in common with other leading nations, has started to recognise this. Recent examples may be found in 2021 Integrated Review³ and National Space Strategy⁴. A cross-Government (x-HMG) PNT team is being discussed, to develop a coordinated and programmatic approach to strengthen national PNT resilience⁵. The outcome of this work is due to be published by the autumn of 2023⁶.

Impact of Losing Positioning and Timing

The impact of a loss of satellite-derived PNT for a multi-day period has been well documented via a series of reports in the UK and the US. A London Economics report put the cost to the UK after a 5-day outage as being £1billion per day⁷. A contemporary United States report reached a similar conclusion⁸. Five years later it’s easy to find informed commentators who believe these estimates to be conservative.

In many ways the economic impact is only a technical manifestation of what would be an alarmingly wide range of serious practical disruptions to everyday services and utilities. The impact for ordinary people would be felt in more ways, and in more places, than many realise. The following scenario is believed to be realistic and is offered for illustrative purposes:

Mapping applications would cease to function or, at best, function with much-reduced utility; emergency services communications, monitoring and routing would be impacted, reducing efficiency and hampering operations; logistics
and transport services would lose functionality, potentially drastically reducing their ability to provide expected services and information; supply chains would break down, leading to shortages of goods and food; communications networks would start to be impacted, with effects growing sharply after a
few weeks⁹.

The above examples support a view held by many experts that normal society could face very serious consequences within a relatively short time in the event of a loss or disruption to satellite-derived time and position. The authors can readily foresee how a timing and position disruption could have more widespread impact than well-published recent examples such as the Eyjafjallajökull volcano ash cloud, or the WannaCry ransomware incident affecting the NHS.

Preparedness Status

Preparedness levels vary significantly between sectors. Some sectors have taken action. Often this action has been as a result of actual events – temporary disruptions which have had a negative impact. These events have acted as a spur to prioritise investment in more resilient approaches to maintaining positioning and timing. For example, “hold- over” synchronisation clocks¹⁰ are now deployed to some level in many sectors, including broadcast, communications, power distribution and financial services. Such back-ups do offer reassurance and significant improvements in resilience. Put simply, they are akin to Uninterruptible Power Supplies (UPS) which are widely deployed to address the risk of power outages. Like UPS, they are effective for a limited period of time but do very significantly improve resilience.

True independence from satellite-derived time or position, however, can be very difficult and costly to achieve, and most systems retain a level of dependency. For example, this could be where high volumes of low cost “nodes” which may well have lower protection, are connected into a “backbone” network; or where second or third order systems rely more than expected on satellite-derived time¹¹. Examples of the former are radio frequency beacons or small cells for communications networks; and of the latter a good example would be ships’ communications and radar systems which can use GPS for synchronisation and/or timing reference.

Assessing positioning and timing resilience is unfortunately not straightforward – there are a wide range of requirements relating to resilience depending on use case; there exists a broad range of mitigations, none of which is perfect; and test/verification approaches are specialist, with agreed standards generally not being in place.

By way of contrast, there are established approaches for good practice within the IT, cyber and software domains. These are well understood and used widely. Examples include: Cyber Essentials Good Practice¹², ISO27001 framework for managing risk¹³, responsible disclosure principles for new threats¹⁴ and “white hat” PEN (penetration) testing¹⁵. Although there are some efforts to bring standard approaches¹⁶, and even “light” regulation forwards¹⁷, the reality is that PNT is less mature than cyber in these areas by a significant margin.

Because of the plethora of applications and requirements for position and time it is evident that there is no one-size-fits-all approach to deliver required resilience attributes.

Recent work on safety assurance for automated transport¹⁸ proposes, in essence, that consistent good practice across all sectors and domains is a good start, but that domain- specific approaches are a necessity to meet the needs of different sectors. A similar conceptual model is also applicable in the context of considering positioning and timing resilience.

Preparedness for a Major Positioning or Timing Crisis or Incident

Dwight D. Eisenhower is credited with making a paradoxical statement about preparation – that planning is essential, but plans are worthless. This refers to the reality that the precise nature of a crisis is not known in advance, so precise plans are rarely of much use. However, the knowledge and understanding gained during a planning process, where possibilities and contingencies are explored and considered, is extremely valuable.

In similar vein, Prussian Field Marshal Helmuth von Moltke the Elder declared in 1871 that “Kein Operationsplan reicht mit einiger Sicherheit über das erste Zusammentreffen mit der feindlichen Hauptmacht hinaus”, which, in essence, may be translated to “No plan survives first contact with the enemy.”

There are, indeed, some parallels between these insights and the Royal Institute of Navigation’s approach over more than 75 years, to improve understanding and effectiveness through sharing knowledge and building understanding between disciplines.

How, therefore, might preparing for a loss of positioning and/or timing be approached? Acknowledging that it makes sense to build on a broader ambition to build national preparedness through resilience, we explore this question here by reference to the UK Government Resilience Framework.

UK Government Resilience Framework

The UK Government Resilience Framework¹⁹ offers an articulation of how the UK Government will deliver on a new strategic approach to resilience. It is based on three core principles:

• A developed and shared understanding of the civil contingencies risks we face is fundamental;
• Prevention rather than cure wherever possible: a greater emphasis on preparation and prevention; and
• Resilience is a ‘whole of society’ endeavour, so we must be more transparent and empower everyone to make a

We are not aware that this framework has been considered or applied in relation to the loss of positioning and timing. At the same time, we can see the applicability and value in these principles in this case. As such, the following paragraphs discuss each of these principles in relation to preparing for a loss of positioning, associated Location Based Services (LBS) and timing.

Shared Understanding of Risks

Raising awareness is an essential first step. Over recent years, there has been tangible progress, with positioning and, particularly, timing resilience now receiving attention at the highest levels within security and critical infrastructure organisations. The recent Government reviews of PNT strategy have been excellent at gathering detailed use case information and this in turn has raised awareness beyond the positioning and timing specialist technology communities. Although a PNT strategy has not yet been announced or published, some important projects to improve resilience have been funded. A key example is the National Timing Centre (NTC) project²⁰. Led by National Physical Laboratories, the NTC project distributes the UK’s reference time. The associated funding to support research and development to further distribute resilient and accurate time to end users, without needing to rely on satellite-derived time, offers potential for UK leadership in this area.

Commercial, transport and logistics operations are generally giving less priority to positioning and timing resilience. This is evidenced in the economic assessment report7 which confirms the highest economic impact from a loss of services in these sectors. The reasons for this are varied, but certainly include the fact that the use of satellite-derived PNT information is sometimes driven by convenience rather than safety, security or resilience.

For example, transport information systems rely widely on satellite-derived position and leads to passenger inconvenience when lost. This inconvenience becomes an operational issue when signaling or control systems rely upon satellite-derived position. There is commercial reliance at stake as well as customer satisfaction. An example close to the everyday experience of many of us, ride-hailing services and all manner of delivery services are commercially dependent on satellite-derived position. As these services grow any impacts would be more costly and disruptive.

The stark reality is that prioritising resilience in the event of service loss is a “below the line” project for most, even if awareness of the service vulnerabilities exists. Some organisations adopt the approach to understand their critical capabilities²¹ and risks, but generally much more needs to be done to raise awareness of the risks and impacts.

Prevention Rather Than Cure

There exists a plethora of approaches to improve resilience of PNT-enabled systems and applications. Figure I below shows more than a dozen approaches, and even then is only illustrative.

Some examples will help to show the potential of combining multiple positioning or timing sources to avoid service loss. When a car enters a tunnel, its GPS signal is lost, but the screen will continue updating for a while. The navigation system is likely taking odometer inputs and combining these with inertial sensor outputs to provide continuity. After a while these “dead reckoning” inputs will become inaccurate. The navigation system may pause and deliver an error message. There may well be a position jump on exit from the tunnel as the system receives an absolute position recalibration from GPS again. A further example would be when a smartphone’s satellite navigation frequencies are overwhelmed by high-power interference such as from a so-called personal privacy device jammer. The smartphone’s positioning “engine” will switch to Wi-Fi positioning, if available. This is generally less accurate than satellite positioning but allows continuity. If Wi-Fi positioning is not available, the phone will step back again to cellular positioning, deriving approximate position from nearby cellular base stations. Again, this is generally less accurate than satellite positioning, but assures continuity.

Although the above examples are at the consumer device level, similar principles apply when adding resilience for more critical applications. For example, military hardware regularly combines GPS and inertial systems, which are very complementary in terms of strengths and weaknesses; and we have already discussed that hold-over clocks can help with timing resilience in communications networks.

When it comes to improving resilience, it is possible to make a marked improvement relatively easily. The rule that an 80% improvement can be achieved with 20% of the input definitely applies to positioning and timing. This correctly implies that to increase protection towards fully protected requires a significant step up in areas such as cost, size, weight, power required and also expertise to achieve.

With dependency on positioning and timing being endemic, and with widely differing implications of failure, system-level understanding is key to proper risk management. Indeed, a systems engineering mindset and approach is becoming widely recognised as essential to successfully define PNT requirements, consider risks and design more resilient systems.

The resulting solutions will typically comprise a System of System Approach (SOSA) to achieving resilience. There are several categories and approaches to SOSA, notably:

a – Alternative source(s)

Ensuring more than one source of position or time information, ideally with diverse and technically dissimilar vulnerability and failure vectors, is a classical approach to improve resilience. For example, a terrestrial source (eLoran or local radio frequency transmitters for example) and a space-based source, or a GPS and an inertial measurement unit.

b – Augmentation

Augmentation in this context means providing another source of information to improve the performance of the system. A wide range of augmentation approaches is available when using satellite-derived time or position. One example is EGNOS (European Geostationary Navigation Overlay System), another would be LAAS (Local Area Augmentation System) with ground-based transmitters at airports. Some improve accuracy. Of more interest are those which improve “integrity”, or trust, in the information being provided. Augmentation systems can identify when a pre-set condition is not met, raising a “flag” either at the system level and/or to the operator.

c – Software-based approaches

Positioning and timing receivers and systems generate a lot of data “under the hood”. Parameters can be checked against those expected in nominal conditions. For example, satellite signals are likely to come from overhead and at very low power, whereas locally- generated spoofing signals will be sharply higher power and thereby possible to detect; vehicles operate within speed and other dynamic limits, so a parameter outside expected limits can be flagged as suspect; some parameters ought to follow a predictable progression, so jumps or discontinuity might well signal low-trust or don’t-trust conditions. Such detection of out-of-bounds parameters by software can flag or reject potentially suspect data with often quite dramatically helpful improvements in resilience.

d – Antenna design

Significant improvements are possible through informed antenna selection. For example, some antennas accept only signals from well above the horizon, defeating ground-based attacks; some antennas, known as CRPA (Controlled Reception Pattern Antenna) amplify wanted signals and/or work to block out unwanted signals.

Assessing risks and choosing appropriate mitigation approaches to improve positioning and timing resilience requires a degree of understanding and skill. There is a range of resources and companies available to help and provide guidance and expertise. Notwithstanding, it is not always easy to find such material. The Royal Institute of Navigation hosts information and resources via a resilient PNT portal²² as well as other information designed to help. However, such an approach is just a start and much more needs to be done.

An enduring PNT programme within Government would:

• provide much-needed governance;
• provide an associated decision framework to prioritise and support further structured and focused work to improve resilience through prevention;
• enable the UK to keep up with evolving technology;
• solidify the view that vulnerabilities described in this paper are not seen as a ‘one-off’ problem with a point solution, but a continuous risk to be addressed.

Empower Everyone To Contribute

Declared ownership at a national level for PNT resilience provides much-needed clarity. The risks from a loss of positioning or timing, whether from natural or hostile factors, have been formally recognised in the National Risk Register 2023²³. We understand from “The Roles of Lead Government Departments” schedule²⁴ dated 18 August 2023 that the Department for Science, Innovation and Technology is identified as departmental owner for a loss of positioning and timing. A PNT Office within Government would provide policy oversight and a focus for review, prioritisation and tracking of key framework projects towards resilience of positioning, location services and timing.

At the organisational level, a few companies have already established ownership at Board or senior management level for PNT risks. Increasing this distributed ownership of risk in this way will be a major step forward. More can be done to provide support, information, advice and training. For example, including the need to mitigate PNT risks within the UK Government’s Business Resilience Planning Assumptions²⁵ guidance may well be appropriate.

Stakeholder engagement forums operate on an ad hoc basis at present, for example the RIN’s PNT Advisory Group aims to share information and has been very well received²⁶. The RIN also provides educational resources on an open basis to the general public²⁷. A more structured approach, led by Government with appropriate expert support, will be a significant step forwards and a potential quick win.

Skills, education, and training have been reviewed as part of Government’s reviews of PNT strategy and resilience²⁸. An enduring commitment via a PNT programme of record in Government will strengthen the willingness of companies, universities and organisations to invest in improving PNT resilience. Analysis concluded that skills development, along with encouraging individuals to invest their careers in PNT, are essential framework elements as part of a successful PNT programme.

Opportunities for Leadership and Growth

The UK has a history of innovation and leadership in many areas, such as PNT security, operation in challenging environments, implementation of new technologies and academic research into complex navigation problems. Indeed, the UK’s leadership will not escape the historian, including as it does iconic figures such as Sir Isaac Newton, John Harrison, Sir Robert Watson-Watt and many others. More recently, positioning and timing innovations over the past 75 years have regularly been “born” in the UK.

While the UK arguably does not have an opportunity for leadership in global navigation satellite systems (GNSS) in the foreseeable future, there is an opportunity to lead in the high growth areas of position-enabled services and applications, and timing synchronisation. A concept paper was written and presented by London Economics to the RIN’s PNT Leadership Seminar in November 2022²⁹. Further work could help to support and focus research and industrial strategy steps towards growth and international leadership in these areas.

Conclusions and Recommendation

This paper has described what has become an over-reliance on satellite-derived time and position, particularly for critical infrastructure and where safety and/or commercial considerations are important. There is no single answer to enable improved performance and resilient positioning, navigation and timing systems. Generically the answer is a so-called system- of-systems approach, blending the strengths of multiple technologies to provide required performance.

Given the endemic nature of dependency, and the reality that the implications of failure vary widely, understanding is key to proper risk management. The vulnerabilities should not be viewed as a one-off problem, something to be solved once, but rather as evolving. The response, therefore, should provide enduring leadership and a framework to keep one step ahead or, at least, to be fit to respond to developments within context and with confidence and clarity.

Our recommendation is that Government must lead. While ownership of risks can be distributed, leadership lies with Government. To achieve this, we see the establishment of a PNT Office in Government as essential. There are many opportunities for UK growth and leadership as the challenge of improving positioning and timing resilience are addressed. In the context of this paper, a core role of the PNT Office must be to ensure adequate preparedness for a loss of positioning and timing services.

References

¹ https://www.euspa.europa.eu/european-space/euspace-market/gnss-market/eo-gnss-market-report

² https://www.gov.uk/government/publications/satellite-derived-time-and-position-blackett-review

³ https://www.gov.uk/government/publications/global-britain-in-a-competitive-age-the-integrated-review-of-security-defence- development-and-foreign-policy

⁴ https://www.gov.uk/government/publications/national-space-strategy

⁵ https://questions-statements.parliament.uk/written-statements/detail/2023-02-23/hcws579

⁶ https://committees.parliament.uk/publications/40289/documents/196651/default/

⁷ https://londoneconomics.co.uk/wp-content/uploads/2017/10/LE-IUK-Economic-impact-to-UK-of-a-disruption-to-GNSS- SHOWCASE-PUBLISH-S2C190517.pdf

⁸ https://www.rti.org/sites/default/files/gps_finalreport.pdf

⁹ https://chronos.uk/resource/dependency-of-communications-systems-on-pnt-technology/

¹⁰ See footnote 9

¹¹ See footnote 2, bottom of p29 and top of p30 for a detailed example

¹² https://www.ncsc.gov.uk/collection/10-steps

¹³ https://www.iso.org/standard/27001

¹⁴ https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure

¹⁵ https://www.ncsc.gov.uk/guidance/penetration-testing

¹⁶ IEEE Standards Association P1952 Committee on Resilient PNT

¹⁷ https://www.transportation.gov/pnt/national-timing-resilience-and-security-act-roadmap-implementation-january-2021

¹⁸ https://warwick.ac.uk/fac/sci/wmg/research/cav/vandv/ukriflf/2023crossdomainsafety_online_final_v2.0.pdf

¹⁹ https://www.gov.uk/government/publications/the-uk-government-resilience-framework/the-uk-government-resilience-framework- html

²⁰ https://www.npl.co.uk/ntc

²¹ http://rethinkpnt.com/wp-content/uploads/2022/09/Website_copy_PNT-System-Resilience-two-column.pdf

²² https://rin.org.uk/page/ResilientPNT

^{23 https://www.gov.uk/government/publications/national-risk-register-2023, published 3 August 2023}

²⁴ https://www.gov.uk/government/publications/list-of-lead-government-departments-responsibilities-for-planning-response-and- recovery-from-emergencies/the-roles-of-lead-government-departments-devolved-administrations-and-other-public-bodies-html

²⁵ https://www.gov.uk/government/publications/business-resilience-planning-assumptions

²⁶ https://rin.org.uk/page/UKPNTAdvisoryGroup

²⁷ https://rin.org.uk/page/Webinars

²⁸ 2021 PNT strategy review, not published.

²⁹ https://londoneconomics.co.uk/blog/publication/london-ec