Chasing Lightning: Detecting, Characterizing, and Identifying a Powerful Space-Based GNSS Interference Source

Abstract: This paper analyzes and identifies a space-based Global Navigation Satellite System (GNSS) interference source that has caused scores of powerful transient wide-area interference events over continental Europe, Greenland, and Canada since 2019. While terrestrial or near-terrestrial sources are primarily responsible for the recent uptick in GNSS interference worldwide, space-based interferers are of special concern given their potential for vast geographic reach and their portent of a qualitative escalation in GNSS interference. Based on data collected between 2019 and 2026 from a network of terrestrial GNSS reference stations, this paper (1) develops a received-power-based detection framework; (2) details the spatial, temporal, and spectral patterns of wide-area interference events caused by the source; (3) presents and analyzes identification techniques that blend received-power and time-difference-of-arrival measurements; and (4) applies these techniques to confidently identify the GNSS interference source as a constellation of Russian early warning satellites in Molniya ("lightning") orbits.

• The paper introduces a detection framework using 1-Hz CNR data from over 160 IGS stations to capture transient high-power GNSS interference events.
• It employs a multi-hypothesis GLRT and TDOA/FDOA measurements from wideband IQ samples to uniquely attribute interference to EKS satellites in Molniya orbit.
• The study highlights the operational threat of deliberate jamming on global GNSS infrastructure and calls for advanced surveillance architectures.

Detecting and Identifying a Space-Based GNSS Interference Source

Overview

The paper "Chasing Lightning: Detecting, Characterizing, and Identifying a Powerful Space-Based GNSS Interference Source" (2606.03673) presents a comprehensive investigation of a series of transient, high-power GNSS interference events impacting broad regions of Europe, Greenland, and Canada since 2019. These events, unprecedented in power and spatial extent, are attributed to a constellation of Russian early warning satellites in Molniya orbits. The study integrates data from a dense terrestrial GNSS network, advanced statistical detection theory, and multi-modal association frameworks to achieve unambiguous identification of the source.

Detection Framework and Event Characterization

The authors develop and validate a power anomaly detection architecture leveraging 1-Hz CNR observables from a network of over 160 International GNSS Service (IGS) stations. The detection statistic $\Lambda_i$ is designed for transient interference with a time-differencing approach, optimized for practical deployment and analytic tractability, with thresholds calibrated to a constant false alarm rate.

Distributions of $\Lambda_i$ for METG (Finland) and MATE (Italy) confirm the Gaussianity and site-specific noise variance under nominal conditions.

Figure 1: The distributions of $\Lambda_i$ under $H_0$ (no interference present) for stations METG ($i = 1$) and MATE ($i = 2$).

A prototypical 3-second interference event is shown impacting METG, MATE, and THU2 (Greenland) in synchrony, with $>$5 dB CNR drops and simultaneous triggering of $\Lambda_i$ above the detection threshold.

Figure 2: Reported CNR (left) and the detection statistic $\Lambda_i$ (right) for IGS stations METG ($i = 1$, Finland), MATE ($\Lambda_i$0, Italy), and THU2 ($\Lambda_i$1, Greenland) over a 15-minute interval on day 160 of year 2021. The dashed red line is the detection threshold with a $\Lambda_i$2 probability of false alarm.

Statistical aggregation reveals events classified by impact: stronger events affect up to 58 stations simultaneously, demonstrating the continental scale of the phenomenon.

Figure 3: The number of stations that detected interference during day 160 of year 2021. The expanded view on the right shows a lower-power event detected by 21 stations, followed by a higher-power event detected by 58 stations.

Geospatial heat maps indicate that the largest CNR degradations consistently center in the Baltic region during major events, with peak reductions exceeding 6 dB.

Figure 4: Heat map of the test statistic (in dB) at triggering stations for the lower-power event (left) and the higher-power event (right). The drop in GPS L1 C/A CNR during the more powerful interference event was as large as 6 dB, centered near the Baltic region.

Temporal, Spectral, and Spatial Analysis

Analysis spanning 2019–2026 identifies 75 days with at least one high-impact event ($\Lambda_i$35 dB CNR drop at a station), revealing non-random timing: events overwhelmingly occur during business days and hours, providing circumstantial evidence of operational, possibly deliberate, human involvement.

Figure 5: Distribution of the day of the week and hour of day (with respect to UTC) during which interference events with at least one station suffering a drop of 5 dB or greater occurred. Clearly, the high-power interference events typically occur during business days and business hours.

Multiple days exhibit clustering and periodicity of bursts, with complex, repeatable spatiotemporal patterns. The strongest events consistently affect Europe, particularly the Baltic, though in rare cases the impact region translates longitudinally—consistent with a satellite platform in high-eccentricity orbit or potential beam steering.

Spectral analyses uncover a persistent interference band centered at 1577.5 MHz (2 MHz above GPS L1), with a typical bandwidth of 5 MHz. On 15 distinct days, correlated CNR drops are observed in BeiDou B1I (centered at 1561.098 MHz), with occasional evidence of the interference source switching to a band centered at 1558.5 MHz.

Figure 6: Uncalibrated average PSD near the GPS L1 band during nominal operation (thick black line) and 1-Hz PSD estimates during 48 transient interference events, as recorded in Gdynia, Poland.

Figure 7: Power spectrum derived from raw wideband samples captured in Amsterdam, Netherlands, during an interference event on February 11, 2026. An initial burst of interference at 1577.5 MHz was followed by a burst at 1558.5 MHz.

Comparative analysis with solar radio bursts (e.g., 2025 X5.1 flare) confirms the distinct, impulsive, band-limited, and rapidly evolving signature of the newly identified interference.

Source Identification: Methods and Results

Elevation-Mask-Based Pruning

A basic reduction of satellite candidates is conducted by applying elevation masks at affected stations, yielding a conic feasible region for the emitter. For strong events, minimum candidate satellite altitudes above 1200 km are consistently obtained. However, this technique alone leaves hundreds of viable space objects per event.

Figure 8: Left: The position of all tracked objects during the high-power interference burst on day 160 year 2021. Right: The position of all satellites that satisfy a 0$\Lambda_i$4 elevation mask, excluding debris and rocket bodies. The feasible region in which the interference source could have been positioned is interior to the red surface. For reference, the colored spherical shell corresponds to medium Earth orbit (20,000 km altitude).

Multi-Hypothesis CNR-Based Likelihood Testing

To further winnow candidates, the authors introduce a multi-hypothesis GLRT framework operating on spatially diverse CNR/CINR vector measurements, parameterized by transmitter power, antenna pattern, and beam pointing—most of which are unknown. Monte Carlo simulations and real-world validation show that with known transmitter and receiver parameters, the framework offers sharp discrimination (unique identification in most epochs). However, performance is more limited when unknowns are maximal, plateauing at $\Lambda_i$510–20 viable candidates per epoch depending on geometry and instrumented antenna richness.

Figure 9: The number of satellites that, for at least 5% of the Monte Carlo trials, remained viable candidates after association testing with $\Lambda_i$6. The legends indicate which parameters are assumed unknown.

TDOA-Based Association with Raw Wideband Data

Definitive source identification is achieved by synchronously capturing wideband IQ samples (60–75 MHz bandwidth) on geographically remote nodes during an interference event. Cross-correlation, after clock alignment, yields high-SNR TDOA and FDOA measurements. Application of Bayesian association across all candidate satellites (with TLE ephemerides) using a 2.3-second TDOA time history reduces the viable candidate set to one: Cosmos 2546 (NORAD ID 45608), a member of the Russian EKS (Edinaya Kosmicheskaya Sistema) constellation, in Molniya orbit.

Figure 10: Left: Example normalized cross correlation at the optimal FDOA. Right: TDOA measurement time history.

All identified events post-2020 coincide temporally and spatially with coverage by EKS satellites, confirming the system as the interference source. Conservative error modeling (TLE error $\Lambda_i$710 km) leaves the identification robust to confounders, and fusion with CNR-based priors further increases confidence.

Theoretical and Practical Implications

The study robustly demonstrates that powerful, transient, space-based GNSS interference is an emergent operational reality, rather than an isolated hardware fault or anomaly. The magnitude, persistence, and purposeful temporal structuring of the events indicate a deliberate capability with wide-area denial implications. The effectiveness of multi-modal association techniques for definitive attribution underlines the necessity of multi-station, high-rate, and raw sample data collection in GNSS interference monitoring.

The presence of interference in the GPS L1 and BeiDou B1I/B1C bands, without artifact in L2/L5, supports hypotheses involving targeted emissions rather than anomalous power amplifier spill or malfunction. The switching of frequency occupancy over time and the occurrence of multi-band interference with clear time separation suggests capability for agile spectrum access, selectivity, and likely reconfigurable waveform structures onboard the EKS satellites.

Importantly, the results imply that nation-state sponsored, space-based GNSS jamming can—if operated persistently—negatively affect continental-scale critical infrastructure, including aviation and international navigation. The CNR-based detection techniques demonstrated are suitable for global monitoring networks but require further extension (including richer antenna pattern libraries and higher-resolution, non-quantized observables) for routine, unambiguous, real-time attribution.

Future Directions

The work motivates development of next-generation GNSS interference surveillance architectures, with increased deployment of wideband front-ends, robust station clocking, and real-time sharing of raw observations. The necessity of incorporating space domain awareness data (updated, accurate TLE cataloging) and cross-domain data fusion for trusted attribution is underscored. There is also a clear need for formal operational procedures—both technological and regulatory—to address the risks posed by deliberate, high-power space-based interference to GNSS-reliant sectors.

Further research should explore real-time geolocation of noncooperative sources from LEO platforms, adaptive suppression and resilience algorithms at the receiver level, and international frameworks for space-based RF activity notification and mitigation.

Conclusion

This paper provides a rigorous and highly detailed account of a persistent large-scale GNSS interference phenomenon sourced from a Russian Molniya-orbit satellite constellation. The integration of rigorous detection theory, advanced likelihood-based association, and direct TDOA/FDOA measurement from raw wideband samples demonstrates a highly reliable methodology for attribution of space-based RF interference, culminating in the identification of EKS satellites as the agents of record-setting GNSS service degradation across Europe and surrounding regions. The results portend a shift in both the operational threat model for global GNSS infrastructure and the requirements for its protection.