A new type of GPS spoofing technology, which may belong to the Chinese government, appears to have been impacting shipping in and around China's Port of Shanghai for more than a year. Unlike previous examples of spoofing attacks, which have typically caused GPS receivers in a certain area to show their locations as being at a limited number of fixed false positions, the incidents in Shanghai caused the transponders on multiple ships at once to show various erroneous positions that forms odd ring-like patterns that some experts have dubbed "crop circles." An article in MIT Technology Review magazine on Nov. 15, 2019, was among the first to delve into the data. The information had come from an investigation that the Center for Advanced Defense Studies, or C4ADS, a Washington, D.C.-based nonprofit, had previously conducted into what has been happening in Shanghai. Todd Humphreys, the head of the Radionavigation Laboratory at the University of Texas at Austin, an expert in GPS jamming, spoofing, and hacking, who had been assisting C4ADS, gave a presentation on the topic at the ION GNSS+ satellite navigation conference in Florida in September.

C4ADS has conducted a number of data-driving investigations since 2012, including one in July of this year on the smuggling of luxury goods, including foreign cars, into North Korea. Another one that the organization published four months earlier delved into Russian GPS spoofing and jamming activities in Ukraine's Crimea region and the Black Sea, elsewhere in Europe, and Syria. Russia has been conducting these kinds of attacks for years and they are well known at this point. However, instances of spoofing linked to the Russians have, typically, caused affected receivers to think that they're all in one incorrect location. A series of such attacks in the Black Sea in 2017 notably caused numerous ships to register their locations at a single point several miles inland.

C4ADS A graphic showing how Russian GPS spoofing incidents in the Black Sea between 2016 and 2018 shifted locations of ships to a limited number of locations, all airports, on land.

C4ADS had not initially been expecting to find anything necessarily unusual about the GPS spoofing in Shanghai after reportedly receiving a tip earlier this year, according to MIT Technology Review. The fact that the port might be experiencing these kinds of attacks was backed up in part by a report that the captain of U.S.-flagged container ship M/V Manukai had filed with the U.S. Coast Guard in July 2018. In that case, as the ship approached the port, another vessel disappeared and reappeared multiple times from its screens, with its transponder alternating between showing its position in one of the traffic lanes and in its berth. The captain of the Manukai eventually confirmed that the other ship had never left the pier. His own ship's GPS systems failed completely as they made their way to their own place on the dock, in what sounds like may have just been more traditional jamming.

Matson The M/V Manukai.

The International Maritime Organization requires most civilian and commercial ships to have a GPS-linked Automatic Identification System (AIS) transponder and broadcast their locations while underway specifically to help ships avoid colliding with each other or other hazards at sea. The risks are very real. For example, the European Maritime Safety Agency (EMSA) found that half of all shipping mishaps that it recorded in 2017 were, at least in part, due to navigation errors that subsequently led to a collision or a ship finding itself grounded on land. C4ADS purchased a significant amount of AIS transponder data from in and around the Port of Shanghai from an unspecified startup company, which further confirmed spoofing attacks occurring at least as far back as Summer 2018. This was clear from AIS data that showed ships' positions on land rather than in the port itself. When C4ADS then went to plot the spoofed ship locations to create a visualization of the data, they discovered something entirely new and very odd. Circular patterns appeared that were unlike any the researchers, and the experts they then reached out to, had ever seen. "To be able to spoof multiple ships simultaneously into a circle is extraordinary technology. It looks like magic," Humphreys, the expert from the University of Texas at Austin, told MIT Technology Review. "People were slack-jawed when I showed them this pattern of spoofing [at the ION GNSS+ conference]. They started to call it crop circles."

C4ADS A "crop circle" of spoofed GPS locations in Shanghai that C4ADS discovered when it plotted the compromised AIS data.

It also wasn't just ships that were suffering the effects. C4ADS found that similar "crop circles" in Shanghai using Strava's "Global Heat Map." This company, which bills itself as a social fitness network, creates this map from the anonymized data that its app collects from users' smartwatches and similar devices. This is ostensibly meant to show things like popular running and cycling routes, as well as general athletic activity. The company did find itself at the center of a controversy last year when it became apparent that the heat map was also effectively highlighting the locations of military and intelligence facilities around the world. What it was showing in Shanghai was that cyclists and anyone else in the city who were using Strava's app were also subjected to the curious spoofing attacks.

Strava Another "crop circle" that appears on Strava's Global Heat Map.