TEDxAustin
Todd Humphreys: How to fool a GPS
Filmed:
Readability: 4.2
787,739 views
Todd Humphreys forecasts the near-future of geolocation when millimeter-accurate GPS "dots" will enable you to find pin-point locations, index-search your physical possessions ... or to track people without their knowledge. And the response to the sinister side of this technology may have unintended consequences of its own.
Todd Humphreys - Assistant Professor
Todd Humphreys studies GPS, its future, and how we can address some of its biggest security problems. Full bio
Todd Humphreys studies GPS, its future, and how we can address some of its biggest security problems. Full bio
Double-click the English transcript below to play the video.
00:17
Something happened in the early morning hours
0
1527
2788
00:20
of May 2nd, 2000, that had a profound effect
1
4315
3585
00:23
on the way our society operates.
2
7900
2306
00:26
Ironically, hardly anyone noticed at the time.
3
10206
3278
00:29
The change was silent, imperceptible,
4
13484
2660
00:32
unless you knew exactly what to look for.
5
16144
2845
00:34
On that morning, U.S. President Bill Clinton
6
18989
2351
00:37
ordered that a special switch be thrown
7
21340
2272
00:39
in the orbiting satellites of the Global Positioning System.
8
23612
3433
00:42
Instantaneously, every civilian GPS receiver
9
27045
3864
00:46
around the globe went from errors the size of a football field
10
30909
4562
00:51
to errors the size of a small room.
11
35471
3935
00:58
It's hard to overstate the effect that this change
12
42314
3791
01:02
in accuracy has had on us.
13
46105
2552
01:04
Before this switch was thrown, we didn't have
14
48657
2247
01:06
in-car navigation systems giving turn-by-turn
15
50904
2259
01:09
directions, because back then, GPS couldn't tell you
16
53163
2592
01:11
what block you were on, let alone what street.
17
55755
2694
01:14
For geolocation, accuracy matters,
18
58449
3248
01:17
and things have only improved over the last 10 years.
19
61697
3258
01:20
With more base stations, more ground stations,
20
64955
2119
01:22
better receivers and better algorithms,
21
67074
2969
01:25
GPS can now not only tell you what street you are on,
22
70043
3063
01:29
but what part of the street.
23
73106
4502
01:33
This level of accuracy
24
77608
2246
01:35
has unleashed a firestorm of innovation.
25
79854
2926
01:38
In fact, many of you navigated here today
26
82780
2671
01:41
with the help of your TomTom or your smartphone.
27
85451
3593
01:44
Paper maps are becoming obsolete.
28
89044
3225
01:48
But we now stand on the verge of another revolution
29
92269
4139
01:52
in geolocation accuracy.
30
96408
1995
01:54
What if I told you that the two-meter positioning
31
98403
2733
01:57
that our current cell phones and our TomToms give us
32
101136
3431
02:00
is pathetic compared to what we could be getting?
33
104567
3897
02:04
For some time now, it's been known that if you pay attention
34
108464
2833
02:07
to the carrier phase of the GPS signal,
35
111297
2535
02:09
and if you have an Internet connection,
36
113832
2481
02:12
then you can go from meter level to centimeter level,
37
116313
2816
02:15
even millimeter-level positioning.
38
119129
2967
02:17
So why don't we have this capability on our phones?
39
122096
3280
02:21
Only, I believe, for a lack of imagination.
40
125376
4370
02:25
Manufacturers haven't built this carrier phase technique
41
129746
3167
02:28
into their cheap GPS chips
42
132913
2106
02:30
because they're not sure what the general public would do
43
135019
2154
02:33
with geolocation so accurate that you could pinpoint
44
137173
3576
02:36
the wrinkles in the palm of your hand.
45
140749
3838
02:40
But you and I and other innovators,
46
144587
2387
02:42
we can see the potential in this next leap in accuracy.
47
146974
4040
02:46
Imagine, for example, an augmented reality app
48
151014
2712
02:49
that overlays a virtual world to millimeter-level precision
49
153726
3537
02:53
on top of the physical world.
50
157263
2008
02:55
I could build for you a structure up here in 3D,
51
159271
2887
02:58
millimeter accurate, that only you could see,
52
162158
2368
03:00
or my friends at home.
53
164526
2893
03:03
So this level of positioning, this is what we're looking for,
54
167419
4515
03:07
and I believe that, within the next few years, I predict,
55
171934
3924
03:11
that this kind of hyper-precise, carrier phase-based positioning
56
175858
4983
03:16
will become cheap and ubiquitous,
57
180841
3224
03:19
and the consequences will be fantastic.
58
184065
2545
03:22
The Holy Grail, of course, is the GPS dot.
59
186610
4656
03:27
Do you remember the movie "The Da Vinci Code?"
60
191266
2680
03:29
Here's Professor Langdon examining a GPS dot,
61
193946
3448
03:33
which his accomplice tells him is a tracking device
62
197394
3377
03:36
accurate within two feet anywhere on the globe,
63
200771
3061
03:39
but we know that in the world of nonfiction,
64
203832
2906
03:42
the GPS dot is impossible, right?
65
206738
2864
03:45
For one thing, GPS doesn't work indoors,
66
209602
2624
03:48
and for another, they don't make devices quite this small,
67
212226
3184
03:51
especially when those devices have to relay
68
215410
2328
03:53
their measurements back over a network.
69
217738
2975
03:56
Well, these objections were perfectly reasonable
70
220713
2338
03:58
a few years ago, but things have changed.
71
223051
3014
04:01
There's been a strong trend toward miniaturization,
72
226065
2856
04:04
better sensitivity, so much so that, a few years ago,
73
228921
3719
04:08
a GPS tracking device looked like this clunky box
74
232640
2704
04:11
to the left of the keys.
75
235344
2176
04:13
Compare that with the device released just months ago
76
237520
2651
04:16
that's now packaged into something the size of a key fob,
77
240171
3792
04:19
and if you take a look at the state of the art
78
243963
2553
04:22
for a complete GPS receiver, which is only a centimeter
79
246516
2746
04:25
on a side and more sensitive than ever,
80
249262
2087
04:27
you realize that the GPS dot will soon move
81
251349
3509
04:30
from fiction to nonfiction.
82
254858
4399
04:35
Imagine what we could do with a world full of GPS dots.
83
259257
4242
04:39
It's not just that you'll never lose your wallet or your keys
84
263499
2906
04:42
anymore, or your child when you're at Disneyland.
85
266405
4571
04:46
You'll buy GPS dots in bulk, and you'll stick them on
86
270976
3781
04:50
everything you own worth more than a few tens of dollars.
87
274757
3967
04:54
I couldn't find my shoes one recent morning,
88
278724
2472
04:57
and, as usual, had to ask my wife if she had seen them.
89
281196
3368
05:00
But I shouldn't have to bother my wife with that kind of triviality.
90
284564
3792
05:04
I should be able to ask my house where my shoes are.
91
288356
2611
05:06
(Laughter)
92
290967
2139
05:09
Those of you who have made the switch to Gmail,
93
293106
3508
05:12
remember how refreshing it was to go from
94
296614
2878
05:15
organizing all of your email to simply searching it.
95
299492
4144
05:19
The GPS dot will do the same for our possessions.
96
303636
4502
05:24
Now, of course, there is a flip side to the GPS dot.
97
308138
4686
05:28
I was in my office some months back
98
312824
2389
05:31
and got a telephone call.
99
315213
2543
05:33
The woman on the other end of the line, we'll call her Carol,
100
317756
3621
05:37
was panicked.
101
321377
2079
05:39
Apparently, an ex-boyfriend of Carol's from California
102
323456
2793
05:42
had found her in Texas and was following her around.
103
326249
3315
05:45
So you might ask at this point why she's calling you.
104
329564
3837
05:49
Well, so did I.
105
333401
1399
05:50
But it turned out there was a technical twist to Carol's case.
106
334800
3991
05:54
Every time her ex-boyfriend would show up,
107
338791
2734
05:57
at the most improbable times and the most improbable locations,
108
341525
4350
06:01
he was carrying an open laptop,
109
345875
2696
06:04
and over time Carol realized that he had planted
110
348571
2843
06:07
a GPS tracking device on her car,
111
351414
2548
06:09
so she was calling me for help to disable it.
112
353962
2909
06:12
"Well, you should go to a good mechanic
113
356871
1988
06:14
and have him look at your car," I said.
114
358859
3284
06:18
"I already have," she told me.
115
362143
2704
06:20
"He didn't see anything obvious,
116
364847
2144
06:22
and he said he'd have to take the car apart piece by piece."
117
366991
3537
06:26
"Well then, you'd better go to the police," I said.
118
370528
3321
06:29
"I already have," she replied.
119
373849
3104
06:32
"They're not sure this rises to the level of harassment,
120
376953
2446
06:35
and they're not set up technically to find the device."
121
379399
3753
06:39
"Okay, what about the FBI?"
122
383152
1506
06:40
"I've talked to them too, and same story."
123
384658
4163
06:44
We then talked about her coming to my lab
124
388821
1670
06:46
and us performing a radio sweep of her car,
125
390491
2548
06:48
but I wasn't even sure that would work,
126
393039
2499
06:51
given that some of these devices are configured
127
395538
2051
06:53
to only transmit when they're inside safe zones
128
397589
2234
06:55
or when the car is moving.
129
399823
3304
06:59
So, there we were.
130
403127
1494
07:00
Carol isn't the first, and certainly won't be the last,
131
404621
2969
07:03
to find herself in this kind of fearsome environment,
132
407590
4935
07:08
worrisome situation caused by GPS tracking.
133
412525
5885
07:14
In fact, as I looked into her case,
134
418410
1803
07:16
I discovered to my surprise that it's not clearly illegal
135
420213
3462
07:19
for you or me to put a tracking device on someone else's car.
136
423675
4433
07:24
The Supreme Court ruled last month that a policeman
137
428108
3880
07:27
has to get a warrant if he wants to do prolonged tracking,
138
431988
4332
07:32
but the law isn't clear about civilians doing this to one another,
139
436320
3516
07:35
so it's not just Big Brother we have to worry about,
140
439836
2630
07:38
but Big Neighbor. (Laughter)
141
442466
3271
07:41
There is one alternative that Carol could have taken,
142
445737
4648
07:46
very effective. It's called the Wave Bubble.
143
450385
5703
07:51
It's an open-source GPS jammer,
144
456088
2935
07:54
developed by Limor Fried,
145
459023
2555
07:57
a graduate student at MIT, and Limor calls it
146
461578
3793
08:01
"a tool for reclaiming our personal space."
147
465371
3885
08:05
With a flip of the switch you create a bubble around you
148
469256
2265
08:07
within which GPS signals can't reside.
149
471521
2247
08:09
They get drowned out by the bubble.
150
473768
2356
08:12
And Limor designed this, in part, because, like Carol,
151
476124
3647
08:15
she felt threatened by GPS tracking.
152
479771
2646
08:18
Then she posted her design to the web,
153
482417
2576
08:20
and if you don't have time to build your own,
154
484993
3742
08:24
you can buy one.
155
488735
774
08:25
Chinese manufacturers now sell thousands
156
489509
2058
08:27
of nearly identical devices on the Internet.
157
491567
3773
08:31
So you might be thinking, the Wave Bubble sounds great.
158
495340
4152
08:35
I should have one. Might come in handy if somebody ever puts a tracking device on my car.
159
499492
3653
08:39
But you should be aware that its use is very much illegal
160
503145
3782
08:42
in the United States.
161
506927
1799
08:44
And why is that?
162
508726
747
08:45
Well, because it's not a bubble at all.
163
509473
3093
08:48
Its jamming signals don't stop at the edge
164
512566
2399
08:50
of your personal space or at the edge of your car.
165
514965
2472
08:53
They go on to jam innocent GPS receivers for miles around you. (Laughter)
166
517437
6236
08:59
Now, if you're Carol or Limor,
167
523673
2751
09:02
or someone who feels threatened by GPS tracking,
168
526424
2625
09:04
it might not feel wrong to turn on a Wave Bubble,
169
529049
3775
09:08
but in fact, the results can be disastrous.
170
532824
3980
09:12
Imagine, for example, you're the captain of a cruise ship
171
536804
2720
09:15
trying to make your way through a thick fog
172
539524
2519
09:17
and some passenger in the back turns on a Wave Bubble.
173
542043
3840
09:21
All of a sudden your GPS readout goes blank,
174
545883
2715
09:24
and now it's just you and the fog
175
548598
3286
09:27
and whatever you can pull off the radar system
176
551884
2600
09:30
if you remember how to work it.
177
554484
3124
09:33
They -- in fact, they don't update or upkeep lighthouses
178
557608
5936
09:39
anymore, and LORAN, the only backup to GPS,
179
563544
4653
09:44
was discontinued last year.
180
568197
2420
09:46
Our modern society has a special relationship with GPS.
181
570617
4913
09:51
We're almost blindly reliant on it.
182
575530
2270
09:53
It's built deeply into our systems and infrastructure.
183
577800
3651
09:57
Some call it "the invisible utility."
184
581451
3628
10:00
So, turning on a Wave Bubble might not just cause inconvenience.
185
585079
3722
10:04
It might be deadly.
186
588801
4370
10:09
But as it turns out, for purposes of protecting your privacy
187
593171
4208
10:13
at the expense of general GPS reliability,
188
597379
3489
10:16
there's something even more potent
189
600868
2160
10:18
and more subversive than a Wave Bubble,
190
603028
3792
10:22
and that is a GPS spoofer.
191
606820
3389
10:26
The idea behind the GPS spoofer is simple.
192
610209
2825
10:28
Instead of jamming the GPS signals, you fake them.
193
613034
3977
10:32
You imitate them, and if you do it right, the device
194
617011
3118
10:36
you're attacking doesn't even know it's being spoofed.
195
620129
3167
10:39
So let me show you how this works.
196
623296
1632
10:40
In any GPS receiver, there's a peak inside
197
624928
2725
10:43
that corresponds to the authentic signals.
198
627653
2635
10:46
These three red dots represent the tracking points
199
630288
2815
10:49
that try to keep themselves centered on that peak.
200
633103
2879
10:51
But if you send in a fake GPS signal,
201
635982
3065
10:54
another peak pops up, and if you can get these two peaks
202
639047
4466
10:59
perfectly aligned, the tracking points can't tell the difference,
203
643513
4718
11:04
and they get hijacked by the stronger counterfeit signal,
204
648231
3311
11:07
with the authentic peak getting forced off.
205
651542
3960
11:11
At this point, the game is over.
206
655502
2167
11:13
The fake signals now completely control this GPS receiver.
207
657669
3737
11:17
So is this really possible?
208
661406
1495
11:18
Can someone really manipulate
209
662901
1723
11:20
the timing and positioning of a GPS receiver
210
664624
1982
11:22
just like that, with a spoofer?
211
666606
2879
11:25
Well, the short answer is yes.
212
669485
2015
11:27
The key is that civil GPS signals
213
671500
2804
11:30
are completely open.
214
674304
1102
11:31
They have no encryption. They have no authentication.
215
675406
3991
11:35
They're wide open, vulnerable to a kind of spoofing attack.
216
679397
3495
11:38
Even so, up until very recently,
217
682892
2575
11:41
nobody worried about GPS spoofers.
218
685467
2392
11:43
People figured that it would be too complex
219
687859
1978
11:45
or too expensive for some hacker to build one.
220
689837
2815
11:48
But I, and a friend of mine from graduate school,
221
692652
3952
11:52
we didn't see it that way.
222
696604
2152
11:54
We knew it wasn't going to be so hard,
223
698756
2473
11:57
and we wanted to be the first to build one
224
701229
1928
11:59
so we could get out in front of the problem
225
703157
2080
12:01
and help protect against GPS spoofing.
226
705237
4106
12:05
I remember vividly the week it all came together.
227
709343
3345
12:08
We built it at my home, which means that
228
712688
3449
12:12
I got a little extra help from my three-year-old son Ramon.
229
716137
4389
12:16
Here's Ramon — (Laughter) —
230
720526
2418
12:18
looking for a little attention from Dad that week.
231
722944
3685
12:22
At first, the spoofer was just a jumble of cables
232
726629
2270
12:24
and computers, though we eventually got it packaged
233
728899
2882
12:27
into a small box.
234
731781
1672
12:29
Now, the Dr. Frankenstein moment,
235
733453
2809
12:32
when the spoofer finally came alive
236
736262
2727
12:34
and I glimpsed its awful potential,
237
738989
2601
12:37
came late one night when I tested the spoofer
238
741590
2736
12:40
against my iPhone.
239
744326
2086
12:42
Let me show you some actual footage from that
240
746412
1617
12:43
very first experiment.
241
748029
1936
12:45
I had come to completely trust this little blue dot
242
749965
3594
12:49
and its reassuring blue halo.
243
753559
1635
12:51
They seemed to speak to me.
244
755194
1075
12:52
They'd say, "Here you are. Here you are." (Laughter)
245
756269
4660
12:56
And "you can trust us."
246
760929
2870
12:59
So something felt very wrong about the world.
247
763799
5118
13:04
It was a sense, almost, of betrayal,
248
768917
2583
13:07
when this little blue dot started at my house,
249
771500
4191
13:11
and went running off toward the north
250
775691
1612
13:13
leaving me behind. I wasn't moving.
251
777303
3895
13:17
What I then saw in this little moving blue dot
252
781198
4233
13:21
was the potential for chaos.
253
785431
2718
13:24
I saw airplanes and ships veering off course, with the captain
254
788149
4142
13:28
learning only too late that something was wrong.
255
792291
4274
13:32
I saw the GPS-derived timing
256
796565
2500
13:34
of the New York Stock Exchange
257
799065
1731
13:36
being manipulated by hackers.
258
800796
1950
13:38
You can scarcely imagine the kind of havoc
259
802746
2968
13:41
you could cause if you knew what you were doing
260
805714
2650
13:44
with a GPS spoofer.
261
808364
3353
13:47
There is, though, one redeeming feature
262
811717
5144
13:52
of the GPS spoofer.
263
816861
2456
13:55
It's the ultimate weapon against an invasion of GPS dots.
264
819317
4601
13:59
Imagine, for example, you're being tracked.
265
823918
3087
14:02
Well, you can play the tracker for a fool,
266
827005
2524
14:05
pretending to be at work when you're really on vacation.
267
829529
2961
14:08
Or, if you're Carol, you could lure your ex-boyfriend
268
832490
2715
14:11
into some empty parking lot
269
835205
1317
14:12
where the police are waiting for him.
270
836522
2301
14:14
So I'm fascinated by this conflict, a looming conflict,
271
838823
5203
14:19
between privacy on the one hand
272
844026
2665
14:22
and the need for a clean radio spectrum on the other.
273
846691
4199
14:26
We simply cannot tolerate GPS jammers and spoofers,
274
850890
3045
14:29
and yet, given the lack of effective legal means
275
853935
3736
14:33
for protecting our privacy from the GPS dot,
276
857671
4099
14:37
can you really blame people for wanting to turn them on,
277
861770
1872
14:39
for wanting to use them?
278
863642
2416
14:41
I hold out hope that we'll be able to reconcile
279
866058
3053
14:45
this conflict with some sort of,
280
869111
3186
14:48
some yet uninvented technology.
281
872297
5430
14:53
But meanwhile, grab some popcorn,
282
877727
3126
14:56
because things are going to get interesting.
283
880853
2127
14:58
Within the next few years,
284
882980
1340
15:00
many of you will be the proud owner of a GPS dot.
285
884320
4254
15:04
Maybe you'll have a whole bag full of them.
286
888574
2348
15:06
You'll never lose track of your things again.
287
890922
3452
15:10
The GPS dot will fundamentally reorder your life.
288
894374
4029
15:14
But will you be able to resist the temptation
289
898403
2682
15:16
to track your fellow man?
290
901085
2992
15:19
Or will you be able to resist the temptation
291
904077
1832
15:21
to turn on a GPS spoofer or a Wave Bubble
292
905909
3295
15:25
to protect your own privacy?
293
909204
2768
15:27
So, as usual, what we see just beyond the horizon
294
911972
3632
15:31
is full of promise and peril.
295
915604
3340
15:34
It'll be fascinating to see how this all turns out.
296
918944
3188
15:38
Thanks. (Applause)
297
922132
2634
ABOUT THE SPEAKER
Todd Humphreys - Assistant ProfessorTodd Humphreys studies GPS, its future, and how we can address some of its biggest security problems.
Why you should listen
Todd Humphreys is director of the University of Texas at Austin's Radionavigation Laboratory -- where he works as an assistant professor in the Department of Aerospace Engineering and Engineering Mechanics. His research into orbital mechanics has made him one of the world's leading experts on GPS technology and the security concerns that arise from its ubiquitous use. In 2008 he co-founded Coherent Navigation, a startup dedicated to creating more secure GPS systems.
Todd Humphreys | Speaker | TED.com