The FAA wants to find jammers in minutes, and it is starting from almost nothing

The US Federal Aviation Administration cannot currently watch its own spectrum in real time, and it has now told industry it wants to locate interference sources in minutes rather than weeks ^[1][2]. A Government Accountability Office audit published on 21 September found that the FAA’s Spectrum Engineering office has no continuous monitoring of interference, spoofing or jamming and relies mainly on investigating incidents after they are reported ^[2]. Three weeks later the FAA briefed vendors, partly at Secret level, on a nationwide capability to detect, classify and geolocate emitters across every aviation band ^[3][4]. Reporting from that event, published on 28 October, shows how far the agency has to go: it has no cost estimate, no schedule and no certification path ^[1][6].

What the data says

GAO-26-108439 reviewed eight spectrum-dependent National Airspace System systems. For seven of them the FAA had no system-specific risk assessment, relying instead on a general spectrum assessment ^[2]. FAA officials told GAO they lack tools to detect interference or spoofing as it occurs, cited funding as a barrier to deploying monitoring on high-risk systems, and said they do not monitor satellite service providers at all ^[2]. GAO also found that ACARS and CPDLC datalinks lack strong authentication and encryption, leaving them open to interception, spoofed messages and jamming ^[2][8]. It made nine recommendations; the third calls on the FAA to implement continuous monitoring of interference, spoofing and jamming. The Department of Transportation concurred with all nine ^[2]. The report cites 2022 incidents near Denver International Airport, where an unauthorised transmitter broadcast on the GPS frequency, and near Dallas, where suspected spoofing led to more than 230 departure delays ^[2].

The FAA’s Federal Register notice of 30 September set the scope ^[3]. The system should monitor all aviation frequencies in use, cover airport surface, terminal, en route and oceanic operations inside and outside the continental US, and work from ground or airborne sensors feeding a central aggregation point ^[3][4]. It should classify signals, characterise emitters, analyse waveforms and protocols, keep a searchable historical archive and correlate RF conditions with flight operations ^[3][4]. The notice gives no frequency range, latency target or geolocation accuracy, says geolocation is required where feasible, and commits the FAA to no acquisition ^[3]. The industry day ran on 13–15 October at MITRE in McLean, Virginia ^[3]. Reports differ on sequence: Military & Aerospace Electronics frames the effort as following the GAO findings, while AVweb says FAA outreach began before the report ^[4][5].

According to IEEE Spectrum, FAA technical operations vice president Dan Murphy said the agency must be able to find a source in “seconds or minutes, not days or weeks” ^[1]. Investigations now take days to a month or more, and intermittent emitters may never be found ^[1][6]. Mark Carmouche of FAA Spectrum Engineering said the agency has no rough order of magnitude for the cost ^[1][7].

Three sensing layers are on the table. The first is ADS-B. Aircraft report navigation integrity about once a second, and degraded values can be aggregated into near-real-time interference maps; Stanford researchers have shown a Bayesian method that estimates jammer location and power from those reports ^[1][12]. Todd Humphreys of UT Austin says the data is noisy, needs heavy traffic and gives nothing where nobody flies ^[1]. The Stanford work tested single jammers only and notes coverage gaps and onboard faults as error sources ^[12].

The second layer is low Earth orbit. Spire describes hybrid time- and frequency-difference-of-arrival geolocation using paired satellites, with a harder single-satellite Doppler option, though it publishes no accuracy figures ^[10]. IEEE Spectrum reports that Spire estimated GPS jammer locations from a single pass, but says there are not yet enough satellites for continuous US coverage ^[1]. HawkEye 360 announced $36m of multi-year RF-geolocation contracts with more than ten allied nations on 19 October ^[15]. The US Space Force has already made commercial satellite monitoring of GPS jamming a standing global operation, though its own cell says initial detections are not precise enough for targeting and are used to cue other sensors ^[9].

The third layer is terrestrial. Austrian firm Dimetor, with ESA NAVISP support, wants to use GNSS receivers on cell towers to build country-scale jamming and spoofing maps; ESA reports no results yet ^[11]. Its chief executive told IEEE Spectrum a network of tens of thousands of sensors could warn pilots well ahead of a jammed area, but coverage would concentrate near airports and cities ^[1][6]. Ground reference networks already show what is possible: Tallinn University of Technology researchers used ten terabytes of Baltic CORS data to separate sustained Estonian denial in 2025 from short Lithuanian outages that may be tropospheric ^[13].

What it means

The gap GAO identified is structural. A regulator that learns of interference from pilot reports cannot distinguish a faulty transmitter from a deliberate spoofer until the event has passed. GPSwise, which processes more than 518 million ADS-B messages a day, told ICAO on 27 October that degraded GPS can persist along a route after an aircraft leaves the affected area ^[14]. Effects travel further than the emitter.

Fusion is the easy part. Humphreys says combining terrestrial, airborne and space data is technically straightforward; certifying that the display is almost never wrong could take years and many millions of dollars ^[1][6]. There is also an adversarial problem. If controllers route traffic around flagged areas, a false alert becomes a denial-of-service tool, so every input must be authenticated ^[1]. That matches GAO’s wider concern: the datalinks that would carry warnings to crews lack strong authentication themselves ^[2].

The procurement model matters too. The FAA is considering buying detection as a service ^[3][5]. That puts commercial RF-intelligence operators, whose main customers are defence and intelligence agencies, inside civil air traffic safety ^[9][15]. Governance, data retention and who receives alerts are not addressed in the notice ^[3][5].

What to do

• Air navigation service providers and regulators should map their own position against GAO’s findings: system-specific spectrum risk assessments, 24/7 monitoring, and visibility of satellite and datalink providers ^[2].
• Build a baseline before buying a system. Aggregate ADS-B integrity data, GNSS reference station carrier-to-noise records and existing receiver logs, and keep them long enough to compare events across months ^[12][13].
• Treat any interference map used operationally as a security-critical input. Require source authentication, cross-checks between independent layers and a documented response to false positives ^[1][2].
• When assessing satellite or terrestrial vendors, ask for measured geolocation error, revisit rate over your airspace and performance against intermittent and multiple emitters; current public material gives few numbers ^[1][10][11].
• Airlines and operators should keep reporting every GNSS anomaly to ATC and their regulator; crowd-sourced reports remain the main data source where sensors are thin ^[1][11].
• Plan for ACARS and CPDLC message integrity in parallel. Detection does not help if spoofed clearances still reach the flight deck ^[2][8].

The electronic intelligence view

What the FAA describes is a civil SIGINT problem: detect, characterise, geolocate and archive emitters over a continent and an ocean, around the clock. Militaries already do versions of this with commercial satellites, and the Space Force treats it as a standing mission ^[9]. The civil version is harder because it must be certified and trusted by controllers, not just analysts. National monitoring services already produce useful numbers: South Korea’s Central Radio Management Service counted 248 days of North Korean GPS jamming in 2025 and ten in 2026 up to 14 September ^[16]. Day counts show trend, not location. The FAA notice asks for both, yet specifies no accuracy, latency or budget ^[3]. Until it does, vendors will sell coverage maps, and operators should judge them on measured error, not marketing reach.