FlySafe was not operational during this event. This analysis reconstructs publicly available signals — to demonstrate how predictive airspace intelligence could have provided advance warning.
GPS Spoofing → GPWS False Alerts
2023–Ongoing — Life-Critical System Corrupted
The Ground Proximity Warning System (GPWS) is the last line of defense against Controlled Flight Into Terrain — the #1 killer in commercial aviation before GPWS was mandated in 1974. GPWS relies on radio altimeter data and GPS position to calculate terrain clearance. When GPS spoofing places an aircraft's apparent position at an airport surrounded by mountains — while the aircraft is actually at FL370 over flat terrain — GPWS calculates negative terrain clearance and commands 'TERRAIN, TERRAIN — PULL UP.' This has happened hundreds of times over the Eastern Mediterranean since 2023. Pilots receive a screaming, flashing, life-critical warning that is completely false. The danger is not the false alert itself — it's what happens when pilots learn to ignore GPWS.
What Happened
Beginning in August 2023 and continuing through the present, a systematic GPS spoofing campaign across the Eastern Mediterranean and the Iraq–Iran border region has corrupted one of aviation's most critical last-line safety systems: the Enhanced Ground Proximity Warning System (EGPWS). What began as a navigational nuisance — false position fixes showing aircraft over nearby airports — escalated into a direct assault on the integrity of terrain avoidance, triggering hundreds of spurious TERRAIN TERRAIN PULL UP alerts aboard aircraft cruising at flight levels far above any real terrain threat.
The mechanism is specific and technical. EGPWS does not rely solely on barometric altitude to compute terrain clearance. Modern implementations — including the Honeywell EGPWS and Collins TAWS systems — integrate GPS-derived position against an onboard worldwide terrain database. When a GPS receiver is spoofed into believing the aircraft is positioned at or near an airport such as Beirut Rafic Hariri International (OLBA), Baghdad International (ORBI), or Damascus International (OSDI), the EGPWS cross-references that false coordinate against a terrain database showing mountains immediately surrounding those airports. The system correctly concludes — given the spoofed data — that terrain clearance is negative or dangerously marginal. It does exactly what it was designed to do: it screams.
The problem is that the aircraft is not over Beirut. It is over flat terrain at FL370, hundreds of miles from the spoofed position. The alert is categorically false. Yet the aural and visual GPWS annunciation is indistinguishable from a genuine terrain encounter. Crews face a life-or-death decision in seconds: comply with the alert and initiate an aggressive pull-up maneuver, or assess the warning as spurious and continue level flight.
- →GPS provides real aircraft position to EGPWS processor
- →Processor cross-references position with terrain database
- →Clearance calculation accurate; alert threshold correctly calibrated
- →Terrain alert triggers only when actual terrain threat exists
- →Crew trust in system remains intact; compliance rate near 100%
- →GPS receiver locked onto spoofed signal; position shifted to OLBA/ORBI/OSDI
- →Terrain database shows mountains surrounding false position
- →EGPWS computes negative clearance; Mode 2 threshold breached
- →TERRAIN TERRAIN PULL UP activates at FL370 over flat terrain
- →Repeated false alerts erode crew confidence in genuine warnings
Warning Signs
The preconditions for EGPWS corruption through GPS spoofing were visible well before the cascade of false terrain alerts began in late 2023. Each signal pointed toward the same systemic vulnerability: a safety-critical avionics system that had never been hardened against deliberate position falsification, operating in airspace where spoofing intensity was already documented and escalating.
IATA and OPSGROUP had documented sustained GPS interference across LLBG, OLBA, ORBI, and OSDI FIR boundaries throughout 2022–2023, with signal strength sufficient to fully override aircraft GPS receivers. The geographic overlap with high-density commercial routes (Europe–Gulf, Europe–South Asia) meant exposure was not limited to regional operators.
Honeywell EGPWS documentation and Collins TAWS certification data had long established that both systems use GPS-derived horizontal position as a primary input to terrain clearance calculations. No spoofing-detection layer existed within the avionics themselves. ICAO's GPWS/TAWS effectiveness reviews had not addressed deliberate position falsification as a threat model prior to 2023.
Early spoofing reports from 2022 already showed a pattern of aircraft GPS receivers locking onto coordinates at or adjacent to specific airports — Beirut (elevation 87 ft, surrounded by Lebanese mountains to 10,000 ft), Baghdad (elevation 114 ft, proximity to Zagros foothills), Damascus (elevation 2,020 ft, Anti-Lebanon range adjacent). This geographic characteristic of the spoofed signals was the direct prerequisite for subsequent EGPWS false alerts — a connection not widely analyzed until OPSGROUP published its deep dive in 2023.
Honeywell EGPWS and Collins TAWS systems process GPS data and apply sanity-check algorithms differently. As spoofing events were reported from A320, A330, B737, B777, B787, and Challenger 604 aircraft — each carrying different avionics fits — the inconsistency in which aircraft triggered false PULL UP alerts and which did not was itself a warning sign of fleet-wide vulnerability with no uniform mitigation.
ICAO PANS-OPS and airline QRH procedures universally mandated immediate, unquestioned compliance with GPWS PULL UP alerts — a protocol established specifically to prevent crews from rationalizing their way through genuine terrain warnings. No regulatory or OEM guidance existed for the scenario where a GPWS alert was itself the product of a corrupted upstream input. Airlines were unprepared to train for a situation that had been considered impossible by design.
Timeline
OPSGROUP and IATA begin logging structured GPS spoofing events over Eastern Mediterranean and Iraq–Iran border airspace. Aircraft report sudden FMS position jumps to Beirut, Baghdad, and Damascus coordinates while transiting at cruise altitude. At this stage, incidents are classified as navigation anomalies; the EGPWS implication is not yet recognized. IATA logs include reports from operators on the Europe–Gulf trunk routes crossing LLBG and ORBI FIRs.
OPSGROUP documents the first confirmed cluster of EGPWS Mode 2 false alerts directly attributable to GPS spoofing. Aircraft operating on routes through LLBG, ORBI, and OSDI FIRs report TERRAIN TERRAIN PULL UP annunciations at FL350–FL390, with radio altimeters simultaneously indicating thousands of feet of terrain clearance. The disconnect between EGPWS alert and radio altimeter reading provides crews with the only immediate cross-check. OPSGROUP issues the first GPS Spoofing: GPWS False Alerts alert to member operators.
Reports accumulate from operators of Airbus A320 and A330 family, Boeing B737, B777, and B787 variants, and Bombardier Challenger 604 business jets — confirming the issue is not limited to a single avionics fit or aircraft type. The involvement of both Honeywell EGPWS and Collins TAWS platforms demonstrates that the vulnerability is architectural rather than firmware-specific. Airlines begin issuing ad-hoc crew notices; no standardized industry procedure exists.
Flight Safety Foundation and ICAO safety analysts formally identify pilot desensitization as the primary long-term risk — not the individual false alert events themselves. Internal airline safety reports from multiple European and Middle Eastern carriers begin documenting crew attitudes toward GPWS in the affected regions: a growing tendency to mentally classify PULL UP alerts as "probably spoofing" before confirming with radio altimeter. This cognitive shortcut, developed as a coping mechanism, directly mirrors the behavior patterns that caused pre-GPWS Controlled Flight Into Terrain accidents.
OPSGROUP reports the cumulative count of false GPWS alerts from GPS spoofing has reached hundreds of documented events since August 2023, with frequency increasing as spoofing infrastructure in the region intensifies. IATA's GPS Interference Impact on Aircraft Safety Systems report (2024) characterizes the situation as an "ongoing systemic safety concern" rather than a series of isolated incidents. Airlines operating Gulf, Levant, and Central Asia routes are disproportionately affected.
Multiple airlines independently develop and distribute GPWS spoofing-specific SOPs to flight crews. Common elements include: cross-check PULL UP alert against radio altimeter before initiating maneuver; verify GPS position plausibility against IRS-derived position; log all suspected false GPWS events for safety reporting. Critically, these SOPs vary by carrier — some mandate immediate pull-up regardless of suspected spoofing; others allow a brief cross-check delay. The inconsistency itself introduces risk when crews transition between operators or aircraft types. No global standardized procedure from ICAO or IATA exists as of the present date.
Honeywell and Collins Aerospace begin internal assessments of spoofing-resistant EGPWS/TAWS architecture. Proposed mitigations include GPS position plausibility gates that cross-check GPS-derived position against IRS position and radio altimeter data before feeding terrain clearance calculations. Certification timelines for retrofitted software remain unconfirmed. The existing installed base across thousands of aircraft remains vulnerable to the documented false-alert mechanism.
Aviation Impact
The impact of this ongoing event must be understood across two distinct dimensions: the immediate operational disruption from hundreds of spurious alerts, and the latent safety regression caused by the erosion of crew confidence in a system that has been the primary barrier against Controlled Flight Into Terrain for five decades.
OPSGROUP's documented count of false EGPWS Mode 2 alerts attributable to GPS spoofing across Eastern Mediterranean and Iraq–Iran border airspace, representing a sustained rate of multiple events per week at peak intensity. Each event requires a real-time crew decision under startle conditions.
The Flight Safety Foundation's historical analysis of CFIT accident rates before and after the 1974 GPWS mandate. Controlled Flight Into Terrain was the single largest cause of fatal air transport accidents before GPWS introduction. The entire safety case for EGPWS rests on unconditional crew compliance — the same compliance now being conditioned by repeated false alerts.
A320, A330, B737, B777, B787, and Challenger 604 have all generated confirmed false EGPWS alerts under GPS spoofing conditions. The cross-platform nature of the vulnerability confirms it is an architectural issue common to GPS-integrated terrain avoidance systems rather than a fleet-specific defect.
As of the current date, no ICAO, IATA, or regulatory authority has issued a standardized procedure for crew response to suspected GPS-spoofing-induced GPWS alerts. Airlines have issued carrier-specific SOPs with inconsistent guidance — some mandating full compliance regardless of suspected spoofing, others permitting radio altimeter cross-check before maneuver initiation.
The most dangerous consequence of this ongoing situation is not any individual false alert — it is the cumulative conditioning of flight crews to associate GPWS PULL UP alerts in the region with spoofing rather than genuine terrain. CFIT accidents, by definition, occur when crews fail to recognize or respond to terrain proximity warnings during approach and departure phases in mountainous environments. The psychological pathway from "this is probably another spoofing false alert" to delayed response to a genuine terrain warning during a dark, IMC approach into Beirut, Kabul, or Kathmandu is direct and documented in pre-GPWS accident records.
The Honeywell EGPWS and Collins TAWS platforms also handle spoofed GPS inputs with measurably different behaviors — meaning crews transitioning between aircraft types may carry incorrect mental models of how their current aircraft's terrain system will behave. A crew that learned on a platform where EGPWS consistently generates false alerts under spoofing conditions may apply the same dismissal heuristic on a platform where the same spoofing scenario produces no false alert — until a real terrain encounter at approach altitude demands immediate response.
Takeaway
The GPS spoofing → EGPWS false alert cascade is a demonstration of second-order safety risk: the primary hazard (false navigation data) generates a secondary hazard (degraded safety system trust) that is more lethal in the long term than the immediate operational disruption. It is also a failure mode that is entirely invisible to any risk assessment framework that treats GPS interference and GPWS reliability as independent domains. The interdependency was there in the avionics architecture from the day EGPWS received GPS integration — it simply was not considered a threat vector until a deliberate spoofing campaign exposed it.
For operators, the practical calculus is difficult. Unconditional GPWS compliance remains the correct protocol in the overwhelming majority of cases — the event that proves fatal is almost always the one where a crew, having dismissed multiple genuine warnings, does not comply with the one that matters. Yet operating for months through an environment generating multiple false PULL UP alerts per week, with no operational guidance distinguishing spoofed from genuine alerts in real time, makes unconditional compliance cognitively unsustainable without clear crew support structures.
The regulatory gap — zero standardized global procedures despite hundreds of documented events across a two-year period — reflects how slowly aviation safety governance moves relative to the pace at which threat actors can deploy and sustain interference infrastructure. By the time ICAO issues binding guidance, the desensitization effect will already be embedded in the route experience of thousands of pilots who regularly operate through the affected FIRs.
FlySafe's GPS interference layer continuously monitors LLBG, OLBA, ORBI, and OSDI FIR boundaries for spoofing signal characteristics, cross-correlating reported position anomalies from aggregated ADS-B and ACARS feeds against known spoofing geographic signatures. When GPS interference reaches the intensity threshold associated with full receiver lock-on to false coordinates — the precondition for EGPWS false alert generation — FlySafe flags affected route segments with a GPWS Integrity Risk advisory, alerting operators before departure that crews should be briefed on the heightened probability of false terrain alerts and the specific cross-check protocol (radio altimeter + IRS position comparison) recommended for the segment. The advisory is route-specific and updated in real time as spoofing intensity varies, allowing operators to brief crews with current-condition data rather than standing regional warnings that crews habituate to and stop reading.
Real-time characterization of GPS interference power and geographic extent across affected FIRs, distinguishing jamming (loss of signal) from spoofing (false position lock) — the latter being the EGPWS-relevant threat mode.
Route-segment probability score for false PULL UP alert generation, incorporating terrain database topography at known spoofed-position coordinates and current spoofing signal characteristics on the segment.
Pre-departure crew brief content generated for affected routes, including specific avionics behavior guidance by aircraft type (Honeywell EGPWS vs. Collins TAWS) and cross-check protocols aligned with carrier SOP where available.
Sources
- —OPSGROUP — GPS Spoofing: GPWS False Alerts Deep Dive (2023–2024, member alert series documenting false EGPWS events across Eastern Mediterranean and Iraq–Iran border regions)
- —Honeywell Aerospace — EGPWS Behavior Under GPS Spoofing Conditions (technical guidance document, 2024, covering GPS input validation and terrain clearance calculation architecture)
- —ICAO — GPWS/TAWS Effectiveness Review and Spoofing Concerns (safety circular addressing GPS-integrated terrain avoidance system vulnerabilities and the absence of standardized crew procedures)
- —Flight Safety Foundation — CFIT Reduction and GPWS History (historical analysis establishing 90% CFIT reduction attributable to GPWS mandate from 1974; baseline for desensitization risk quantification)
- —IATA — GPS Interference Impact on Aircraft Safety Systems (2024 report characterizing GPS spoofing as a systemic safety concern affecting terrain avoidance, navigation, and crew workload across multiple FIRs)
This is a retrospective analysis of publicly documented events. FlySafe's prediction system was not operational during this event. All information is sourced from public records, aviation authority publications, airline statements, and open data.