Detect GNSS interference from aircraft data

§01Why does aircraft data reveal GNSS interference?

Most aircraft compute their ADS-B position from GNSS and broadcast, alongside it, how confident they are. Two fields carry that confidence. NACp (Navigation Accuracy Category for position) bounds the 95% horizontal position error; NACp 8 means better than 0.05 NM (93 m) and NACp 0 means worse than 10 NM or unknown⁶Source 6 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle (2nd ed.) — Uncertainty: NIC, NAC and SILmode-s.org. NIC (Navigation Integrity Category) gives a containment radius within which the true position should lie; NIC 7 corresponds to under 0.2 NM (370 m)⁶Source 6 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle (2nd ed.) — Uncertainty: NIC, NAC and SILmode-s.org. US rules require compliant ADS-B Out installations to report NACp better than 0.05 NM and NIC better than 0.2 NM, and to broadcast NIC changes within 12 seconds and NACp changes within 10 seconds⁵Source 5 · Cornell Law School Legal Information Institute14 CFR § 91.227 — ADS-B Out equipment performance requirementslaw.cornell.edu. In other words, under normal conditions a modern airliner reports NACp ≥ 8 and NIC ≥ 7, and when its GNSS degrades, it says so quickly.

Researchers have used this repeatedly. Studies of OpenSky data show NACp falling from values above 8 to 0 when aircraft are affected by radio-frequency interference, and recovering once they leave the affected area²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch. NIC is carried in every airborne position message (every 0.4–0.6 s), while NACp travels in the less frequent operational-status message (every 2.4–2.6 s), which is why some work prefers NIC as a per-position proxy for GNSS reception quality³Source 3 · Liu, Lo, Blanch, Chen, Walter — NAVIGATION 72(3), 2025Locating GNSS Interference Sources using ADS-B with Non-linear Least Squaresnavi.ion.org. Public maps such as GPSJAM aggregate the same kind of signal daily into hexagons⁴Source 4 · GPSJAM.orgGPSJAM — Frequently asked questionsgpsjam.org. The relevance is not academic: EASA reports increasing jamming and spoofing since February 2022, especially around conflict zones, and asks air navigation service providers to collect and communicate information on GNSS degradation¹Source 1 · European Union Aviation Safety Agency (EASA), 2026Global Navigation Satellite System outages and alterations (SIB 2022-02R4)easa.europa.eu.

§02Step 1: make sure you have the right quality fields

Open state-vector APIs often omit NIC and NACp; the OpenSky live state vector does, for example. You need decoded airborne-position and operational-status messages from your own receivers or a historical source. Research using OpenSky merged state vectors with NACp decoded from operational-status messages on the aircraft address and timestamp²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch; the ingestion guide adds the nic, nacp and nacp_age_s columns for exactly this purpose.

§03Step 2: decide which aircraft can testify

Some aircraft report NACp 0 all the time, for example because they have no GNSS receiver. Counting them as "degraded" would paint permanent false interference wherever they fly. Figuet and colleagues handled this by labelling a flight as affected only if it reported NACp = 0 for more than 60 seconds cumulatively and NACp above 7 for more than 60 seconds²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch. The idea generalizes: an aircraft is an eligible witness only if it showed good quality at some point in the same flight.

1234567891011121314151617181920212223create or replace view nav_quality_positions as
with per_flight as (
  select
    f.flight_id,
    sum(case when s.nacp >= 8 or s.nic >= 7 then 1 else 0 end) as good_positions
  from flights f
  join state_vectors_clean s
    on s.icao24 = f.icao24
   and s.obs_time between f.first_seen and f.last_seen
  group by f.flight_id
)
select
  s.*,
  f.flight_id,
  (pf.good_positions >= 60)                           as eligible,   -- ~30 s of good NIC at 2 Hz
  (s.nic is not null and s.nic < 7)
    or (s.nacp = 0 and coalesce(s.nacp_age_s, 99) <= 10) as degraded
from state_vectors_clean s
join flights f
  on s.icao24 = f.icao24
 and s.obs_time between f.first_seen and f.last_seen
join per_flight pf on pf.flight_id = f.flight_id
where not s.on_ground;

Two details in that query matter. The NACp test only trusts values received in the last 10 seconds (nacp_age_s), because a stale NACp attached to a fresh position can make an aircraft look degraded long after it recovered. And eligibility is computed per flight, not per aircraft, because the same airframe can fly with different equipment states on different days.

§04Step 3: require persistence per aircraft

A single degraded position is usually noise: a decoding issue, a brief antenna masking during a turn, a receiver glitch. Mark an aircraft as affected in a window only if it accumulated enough degraded time there. We default to 60 seconds cumulative, matching the published criterion²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch; at the nominal 2 Hz position rate that is up to about 120 degraded position messages, fewer where reception is patchy, which is why the query below sums time rather than counting messages.

1234567891011121314create or replace table nav_quality_aircraft as
select
  h3_latlng_to_cell(lat, lon, 4)      as h3_cell,
  date_trunc('hour', obs_time)        as window_start,
  case when baro_alt_m < 3000 then 'low'
       when baro_alt_m < 7500 then 'mid' else 'high' end as alt_band,
  icao24,
  -- approximate degraded seconds from position spacing (capped at 5 s per gap)
  sum(case when degraded then least(coalesce(
        extract(epoch from obs_time - prev_time), 0), 5) else 0 end) as degraded_s,
  bool_or(degraded)                   as any_degraded
from nav_quality_positions
where eligible
group by all;

§05Step 4: aggregate into hexagonal cells

Hexagons are the standard choice because every neighbor is equidistant and cells tile without the distortion of latitude-longitude squares. The resolution is a tradeoff between spatial detail and sample size: each cell needs enough eligible aircraft per window to produce a stable share. Start coarse (H3 resolution 3 or 4 for regional daily maps), check the distribution of aircraft per cell, and only refine where traffic is dense. The 2022 Eastern Europe study similarly presented results in hexagonal bins as a percentage of reports with NACp 0, removing the dependence on traffic volume²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch.

The subtract-one step comes from GPSJAM, which computes 100 * (bad − 1) / (good + bad) per hexagon to reduce false positives in cells with few flights⁴Source 4 · GPSJAM.orgGPSJAM — Frequently asked questionsgpsjam.org. It also means that very sparse cells can hide genuine interference, which is one more reason to show sample size next to every value.

123456789101112131415161718192021222324252627create or replace table nav_quality_cells as
with agg as (
  select
    h3_cell, window_start, alt_band,
    count(*)                                         as eligible_aircraft,
    count(*) filter (where degraded_s >= 60)         as affected_aircraft
  from nav_quality_aircraft
  group by all
)
select
  a.*,
  greatest(a.affected_aircraft - 1, 0)::double
    / nullif(a.eligible_aircraft, 0)                 as degraded_share,
  (a.eligible_aircraft >= 8)                         as sample_ok,
  (c.aircraft is not null)                           as coverage_ok,
  case
    when a.eligible_aircraft < 8 or c.aircraft is null then 'insufficient'
    when greatest(a.affected_aircraft - 1, 0)::double / a.eligible_aircraft > 0.10 then 'high'
    when greatest(a.affected_aircraft - 1, 0)::double / a.eligible_aircraft >= 0.02 then 'elevated'
    else 'normal'
  end                                                as indicator_band
from agg a
left join (
  select h3_cell_to_parent(h3_cell, 4) as h3_cell, hour, alt_band, sum(aircraft) as aircraft
  from coverage_cells group by all
) c
  on c.h3_cell = a.h3_cell and c.hour = a.window_start and c.alt_band = a.alt_band;

§06Step 5: choose thresholds you can defend

There is no universal threshold, and you should resist inventing precision you do not have. A transparent starting point is the band structure GPSJAM publishes for daily maps: under 2% of aircraft reporting low accuracy is shown as normal, 2–10% as elevated, and more than 10% as high⁴Source 4 · GPSJAM.orgGPSJAM — Frequently asked questionsgpsjam.org. We use the same bands by default, add a minimum of 8 eligible aircraft per cell and window (a Kimo default, not a published standard), and evaluate hourly and daily windows separately.

Altitude deserves its own dimension. In the 2022 Eastern Europe study, low-flying aircraft tended to be less affected than those at higher altitudes²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch, which is consistent with line-of-sight radio propagation. A cell that is "high" at cruise altitude and "normal" for low traffic is therefore not contradictory, and splitting by band avoids averaging the effect away.

§07How do jamming and spoofing differ in the data?

EASA defines jamming as interference that prevents receivers from locking onto satellite signals and spoofing as counterfeit signals that deceive receivers, and notes symptoms such as position discrepancies, time shifts and spurious terrain warnings¹Source 1 · European Union Aviation Safety Agency (EASA), 2026Global Navigation Satellite System outages and alterations (SIB 2022-02R4)easa.europa.eu. In ADS-B data the two leave different fingerprints, and the method above is designed for the first.

Kimo keeps a separate, conservative "position integrity" signal built from the implausible_jump flag in the ingestion model and from disagreement between ADS-B and MLAT positions where available. It never labels a cell as spoofing on its own; it raises a review task for an analyst, who compares with official information.

§08Step 6: validate against official information

An indicator layer earns trust by agreeing with independent information where it exists. EASA maintains, alongside its Safety Information Bulletin (in its fourth revision as of 3 July 2026), a page of affected flight information regions derived from ADS-B data¹Source 1 · European Union Aviation Safety Agency (EASA), 2026Global Navigation Satellite System outages and alterations (SIB 2022-02R4)easa.europa.eu. The EASA–IATA mitigation plan calls for standardized NOTAM Q-codes for GNSS interference and timely sharing of interference event data⁷Source 7 · EASA press release, 2025EASA and IATA publish comprehensive plan to mitigate GNSS interferenceeasa.europa.eu. Join your daily cells to active notices and to the authority's published regions: matches are corroboration; persistent "high" cells without any official mention are candidates for reporting through your proper channel, not for publication.

§09What are the limitations of this method?

• Delayed degradation. Aircraft with tightly integrated GNSS and inertial navigation may report reduced quality late, which distorts the apparent area and duration²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch.
• Invisible already-degraded flights. A flight that enters your area already at NACp 0 cannot be counted as newly affected²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch.
• Coverage holes. Data over water and in some regions is thin or absent, and cells without traffic or receivers stay blank²Source 2 · Figuet, Waltert, Felux, Olive — Engineering Proceedings 28(1), 12, 2022GNSS Jamming and Its Effect on Air Traffic in Eastern Europedigitalcollection.zhaw.ch⁴Source 4 · GPSJAM.orgGPSJAM — Frequently asked questionsgpsjam.org.
• Not every red cell is hostile. GPSJAM notes that low accuracy can have other causes, including testing of military systems, and that a short disruption can color a whole day⁴Source 4 · GPSJAM.orgGPSJAM — Frequently asked questionsgpsjam.org.
• Altitude bias. Aircraft at altitude can experience interference that people on the ground do not⁴Source 4 · GPSJAM.orgGPSJAM — Frequently asked questionsgpsjam.org.
• Localization is hard and assumption-heavy. Published source-localization methods assume a single, static, unobstructed source and adequate receiver coverage³Source 3 · Liu, Lo, Blanch, Chen, Walter — NAVIGATION 72(3), 2025Locating GNSS Interference Sources using ADS-B with Non-linear Least Squaresnavi.ion.org. Kimo does not attempt it; leave attribution to authorities.

§10Running it in Kimo

The GNSS interference monitor template packages the models above with simulated data, a daily map, an hourly drill-down by altitude band, and an alert rule that fires when a cell cluster stays "high" for two consecutive hours. Thresholds are declared in YAML so changes are reviewed and logged.

123456789101112131415161718model: nav_quality_cells
source: nav_quality_cells
time_dimension: window_start
parameters:
  persistence_seconds: 60
  eligibility_good_positions: 60
  min_eligible_aircraft: 8
  bands:
    elevated: 0.02
    high: 0.10
measures:
  degraded_share: { sql: "sum(greatest(affected_aircraft - 1, 0)) / nullif(sum(eligible_aircraft), 0)", format: percent }
  cells_high: { sql: "count(*) filter (where indicator_band = 'high')" }
  cells_insufficient: { sql: "count(*) filter (where indicator_band = 'insufficient')" }
caveats: >
  Indicates where eligible aircraft reported degraded GNSS quality.
  Not evidence of a source location or intent. Coverage-gated.
retention: 400d

Open the result in the Airspace view with the coverage layer on, and see Airspace alerting rules that analysts trust for the alert definition. For the wider context, including privacy and licensing, read the whitepaper Airspace Awareness from Open Data and the shorter blog post on mapping interference.