Spectrum of Liability: Forensically Sound Acquisition of Wireless Evidence for the Reconstruction of Maritime Cyber-Physical Incidents

Spectrum of Liability: Forensically Sound Acquisition of Wireless Evidence for the Reconstruction of Maritime Cyber-Physical Incidents

arXiv:2610.25411v1 [cs.CR] 18 Oct 2026

Giacomo Longo CASD School of Advanced Defense Studies, Italy giacomo.longo@unicasd.it Alessio Merlo CASD School of Advanced Defense Studies, Italy alessio.merlo@unicasd.it

Enrico Russo DIBRIS School of Advanced Defense Studies, Italy enrico.russo@unicasd.it

Abstract

inherently fragile due to extremely low received power, and AIS messages are easy to manipulate at the protocol level [6].

Modern maritime navigation depends on mandatory wireless inputs, most notably GNSS and AIS, whose reception can be spoofed or jammed. When groundings or collisions occur, liability and safety investigations often turn on whether RF interference corrupted bridge instruments, yet the artifacts typically available (VDR outputs, IBS logs, screenshots, decoded messages) are downstream, lossy, and easy to contest in adversarial proceedings. We introduce a forensically sound acquisition methodology that preserves upstream wireless evidence together with the minimal contemporaneous context needed to interpret it. Our system records coherent, multichannel IQ across relevant bands while simultaneously collecting time-aligned receiver and instrument-state metadata (e.g., decoded AIS/GNSS outputs and NMEA sentences), enabling later re-decoding and physical-layer reanalysis tied to what the onboard stack indicated at the time. To make the record independently auditable, we package samples and metadata into a single append-only forensic envelope that cryptographically binds per-stream hash chains with trustedtime anchors and periodic checkpoints, allowing third parties to detect tampering (modification, truncation, splicing, crosscase substitution) and to verify the claimed recording window. A prototype implementation shows the approach is practical: integrity mechanisms add negligible storage overhead and modest compute cost at operationally relevant multiband capture rates.

1

Alessandro Cantelli-Forti RaSS National Laboratory CNIT, Italy alessandro.cantelli.forti@cnit.it

This fragility is no longer hypothetical. Large-scale GNSS interference regions are continuously reported [68], and recent casualties have been publicly attributed to suspected spoofing/jamming. For instance, the containership MSC ANTONIA grounded near Jeddah in May 2025, with multiple independent analyses pointing to GNSS interference as a contributing factor [51]. Similarly, the June 2025 collision between the tankers Front Eagle and ADALYNN occurred in a context of heightened concern about GNSS disruption in the Gulf/Hormuz area [70]. Beyond safety outcomes, insurers explicitly treat GNSS interference as an emerging operational and claims-handling issue, especially in geopolitical conflict zones [21]. Yet, a crucial question quickly emerges: how can a shipowner (or an investigator) demonstrate, credibly and reproducibly, that a wireless attack contributed to an incident that occurred? Today, the evidence typically available is downstream: operational logs, screenshots, and decoded message outputs. These artifacts are often insufficient when the dispute depends on signal-level phenomena that are lost after demodulation and decoding (e.g., interference characteristics, timing consistency, and signal evolution over time). Moreover, because they are downstream and curated, they rarely provide an independently verifiable guarantee that the full RF observation window was preserved without gaps or later alteration. This paper addresses the resulting evidentiary gap. We present a forensic acquisition methodology that preserves upstream RF evidence together with the minimal contemporaneous context needed to interpret it, and packages both into a single tamper-evident record that third parties can independently verify. The goal is not to attribute attackers or interpret legal causation, but to enable reproducible, adversarial scrutiny of “what was received” and “what the onboard stack output at that time,” without relying on one party’s subjective interpretation.

Introduction

Modern commercial shipping relies on radio-based navigation and situational-awareness systems whose outputs are treated, in practice and regulation, as authoritative inputs to safetycritical decisions. Two of the most consequential are Global Navigation Satellite Systems (GNSS) (for position/time) and Automatic Identification System (AIS) (for cooperative traffic awareness). Yet both were designed without adversarial radio frequency (RF) environments in mind: GNSS reception is

We provide the following contributions: 1

• A method for forensically sound acquisition of wireless evidence that combines (i) coherent multichannel RF (IQ) recording to preserve the raw ether for re-decoding and physical-layer measurements and (ii) in-band, timealigned metadata (e.g., receiver state, National Marine Electronics Association (NMEA) sentences, and decoded AIS/GNSS artifacts) to reconstruct what the instruments actually observed.

Within the IBS, derived outputs from sensors and radio receivers, together with equipment status, are exchanged over standardized shipboard data interfaces, commonly exposed as NMEA-style messages and networks (IEC 61162 family) [26]. These interfaces feed different consumers, primarily bridge displays and recording units, which aggregate and transform such inputs into operator-facing products and logs. On the display side, Radar information is commonly rendered as a Plan Position Indicator (PPI), i.e., a processed visualization of radar returns, optionally augmented with tracked targets [31]. Radar installations may also support georeferenced functions (e.g., stabilized presentation and chart overlays) that depend on PNT and heading inputs. Alongside radar, Electronic Chart Display and Information System (ECDIS) is the primary charting/navigation display [35]. When the GNSS is unavailable or degraded, the above system may indicate an Estimated Position (EP) by using dead reckoning from a previous fix and relying on onboard navigation sensors (e.g., heading and speed). Finally, ships may carry a Voyage Data Recorder (VDR), which records selected bridge data items, including audio and replicas of key displays [33].

• A verification mechanism for the forensic record that enables automatic checking of (i) the integrity of the evidentiary record and its custody trail, and (ii) the claimed time span of the recording, by cryptographically binding samples and metadata in a Single Source of Truth (SSoT) envelope with trusted time anchors. • An extensive experimental evaluation quantifying storage and runtime overhead across representative multiband acquisition profiles, showing feasibility at operationally realistic rates. Although this paper is motivated by maritime GNSS/AIS interference, our core contribution is a protocol-level methodology for producing verifiable RF evidence, applicable to other safety-critical wireless ecosystems such as aviation, intelligent transportation, and industrial communications (§8). Structure of the paper. We first provide background (§2) and a threat model (§3), then motivate the evidentiary gap and define our goals (§4). In §5, we review related work. We then present our methodology (§6) and evaluate it in §7. We conclude with a discussion (§8) and closing remarks (§9).

2 2.1

2.2

Software Defined Radios

Software-defined radios (SDRs) expose the received waveform as a stream of complex baseband samples. For a channel tuned to center frequency fLO , the analog RF signal is mixed to baseband, low-pass filtered, and sampled at rate fs , producing a discrete-time sequence       x k = I k + jQ k , k ∈ N   Representation of x k depends on the hardware, but typical formats include signed 8-bit or 16-bit interleaved IQ (commonly referred to as SC8 and SC16) and 32-bit float IQ (CF32). Most SDR platforms maintain a hardware time counter Tdev driven by the sampling clock. When the radio is locked to an external reference (typically a 10 MHz square wave) and a 1 Hz pulse-per-second (PPS) signal, often provided by a GPSdisciplined oscillator (GPSDO), Tdev can be aligned to UTC and kept stable over long recordings; a common mode arms the receiver and starts streaming on the next PPS edge [18]. Letting t0 denote the UTC time of that edge, the k-th complex sample is associated with t(k) = t0 + fks , whereas without an external reference, t0 is only relative to the device-local clock. Although x[k] is conceptually continuous, SDR drivers deliver samples in variable-sized buffers; typically accompanied by per-block metadata (e.g., Tdev for the first sample and status flags such as overflow/dropped-sample indications). SDRs are operated through vendor drivers that expose APIs to configure RF/analog parameters such as center frequency fLO , sampling rate fs , gain stages, filter bandwidth, antenna port, and to control the streaming lifecycle (start/stop, timed starts, and time-counter reads).

Background Maritime Bridge Systems and Data Flows

Modern ship bridges are commonly organized as an Integrated Bridge System (IBS) [27, 29], where multiple sensors and radio receivers provide navigation-relevant upstream inputs that are processed, collected, and presented as downstream outputs on dedicated consumers. Among its integrated functions, an IBS provides onboard systems with a Position, Navigation, and Timing (PNT) function as a common navigation state and time base. Core RF-based inputs include: (i) GNSS receivers, which provide World-wide Position, Velocity and Time (PVT) [28, 34]; (ii) maritime Radar [30], which provides local noncooperative sensing of surrounding targets and environmental returns; and (iii) AIS [37], a Very High Frequency (VHF) communication system with periodic cooperative transmissions of structured messages; for vessels, these include position, course, and speed. In addition, bridges use inputs from conventional navigation sensors, including heading (gyrocompass), depth, and speed measurements. 2

3

Threat Model

evidentiary weaknesses or competing accounts in adversarial settings. Access: post-incident access to produced artifacts and analysis tooling; may obtain evidence through one or more parties rather than direct acquisition. Capabilities: can audit and reprocess provided data; in adversarial settings, can dispute completeness, integrity, and timing, and may perform post-processing on artifacts (e.g., truncation, re-ordering, splicing, or cross-case substitution) to support a preferred narrative.

We target modern vessels equipped with an IBS and two RF inputs (GNSS and AIS). Beyond standard bridge systems, the vessel hosts a dedicated forensic appliance implementing our acquisition methodology (§6.3), which we refer to as RFbox. RFbox includes a Trusted Platform Module (TPM) 2.0 acting as the hardware root of trust. A Reference Manifest is created at commissioning and cryptographically bound to the provisioning authority (e.g., via a signature); it encodes the golden Platform Configuration Registers (PCR) measurements [50] for hardware topology, firmware configuration, and the authorized software stack. RFbox generates the local private key inside the TPM and seals it to the expected PCR state; the TPM releases the key only when current measurements match the Reference Manifest. We assume the TPM’s security properties hold against software-only adversaries (e.g., Common Criteria EAL4+ or higher); invasive physical tampering is out of scope. We assume access to a Time Stamp Authority (TSA) that is not controlled by the adversary, and we rely on standard cryptographic assumptions (collision-resistant hashes and unforgeable signatures). Finally, we assume RFbox remains physically available after an incident (not stolen, hidden, or destroyed). In this context, we distinguish three classes of actors, characterized by their incentives, access to relevant systems and evidence, and capabilities.

4

Motivations and Goals

In this section, we motivate the work with a representative case study, then show how the evidentiary gap plays out in safety investigations, claims handling, and formal proceedings. We conclude with concise goals and non-goals for our methodology. Motivating example. Gard is a specialised marine insurer providing Protection and Indemnity (P&I) liability cover [20]. The following case study is drawn from Gard’s published discussion of RF interference in conflict zones [21] and is based on GNSS-disruption claims1 it has handled. In Case Study 1, a vessel lost GPS signal in the Red Sea and subsequently relied on the ECDIS EP function (§ 2.1) while navigating towards port. Hours later, the crew observed unusual sea-surface coloration (mistakenly believed to be seaweed) and the vessel grounded on corals at 11.3 knots, causing substantial damage to the hull and the coral reef. To establish the grounding location, the Flag State used external tracking data to confirm that the vessel was more than 40 NM away from the ECDIS EP.

Attackers. Attackers are external RF adversaries whose actions target GNSS and/or AIS reception via cyber and electromagnetic activities (CEMA). Incentives: degrade situational awareness and induce unsafe behavior while preserving plausible deniability. Access: external-only, via RF transmissions; no assumed access to onboard networks, bridge systems, or RFbox. Capabilities: can transmit interference and protocolvalid signals against GNSS and AIS receivers (e.g., jamming, spoofing, replay/meaconing), and can vary power, timing, and directionality to affect specific areas or time windows. Victims. Victims include RF-attack-affected parties that rely on IBS outputs or bear operational and financial exposure, such as the crew/operator and the shipowner. Incentives: minimize operational and legal exposure by supporting their account of events in the aftermath of an incident. Access: physical presence and operational control onboard; first-party custody of onboard artifacts immediately after an incident. Capabilities: can provide accounts of operations and decide what locally stored artifacts are produced post-incident; in adversarial settings, they may curate, omit, or modify such artifacts (e.g., truncation, selective preservation, or editing). Investigators. Investigators include authorities, insurers (and their claim assessors), and independent experts who review incidents in the context of proceedings or claims. Incentives: reach defensible conclusions and, where applicable, challenge

Safety investigation. Marine safety investigations aim to reconstruct causal factors through a methodical, evidencebased approach rather than adjudicating fault. This paradigm, as mandated by the IMO Casualty Investigation Code [32], requires a rigorous distinction between direct observations and post-hoc inferences. However, PNT-related casualties, such as the grounding case study analyzed here, present a significant evidentiary challenge. In this incident, the crew navigated using ECDIS EP after a GNSS loss, with the final grounding location being established only later through third-party tracking. While investigators rely heavily on VDR and IBS logs to reconstruct the timeline, these artifacts are inherently downstream (§ 2.1). Such records capture what was displayed and acknowledged on the bridge; yet, they fail to preserve the low-level signal conditions or receiver observables necessary to verify the root cause. Consequently, when RF interference is hypothesized as the trigger, the available evidence consists merely of indirect symptoms. Without independent access to the upstream RF 1 referred to as “GPS” in the cited source

3

layer, it becomes nearly impossible to empirically distinguish between external interference and benign alternatives, such as receiver-specific faults or configuration issues. Insurance claims. The maritime insurance landscape is governed by model wordings produced by specialized industry bodies, primarily the Institute of London Underwriters (ILU), now International Underwriting Association of London (IUA) [39], and the Lloyd’s Market Association (LMA) [47]. These frameworks partition risks into distinct legal domains: the Institute Time Clauses (ITC-Hulls) [24] for standard marine perils, the Institute War and Strikes Clauses (IWSC) [25] for conflict-related hazards, and the more recent Cyber Attack Exclusion Clauses (CL380 [23] and LMA5403 [46]). Each framework is identified by a unique Market Clause (CL) reference number and serves as the deterministic logic for financial liability. In our case study, the vessel lost reliable GNSS inputs, navigation degraded, and the vessel grounded. Even if this sequence is not disputed, the parties may still dispute the label of the cause. The same grounding event can be argued as a Marine Peril (e.g., crew negligence under ITC-Hulls cl. 6.2.3), a War Peril (e.g., hostile acts under IWSC cl. 1.1), or a Cyber Event. In the latter case, cyber clauses are written broadly and depend on hard-to-answer questions, such as intent and whether the vessel was a target or a collateral victim. As a result, bridge-level artifacts may be insufficient to determine how the loss should be framed under the relevant wordings, as they are downstream symptoms rather than evidence of the interference mechanism. Formal proceedings and evidence handling. When disputes escalate into formal proceedings, the focus shifts from operational outputs to the evidentiary weight of the records. Latest industry guidelines [7] emphasize that rigorous evidence preservation is a critical requirement for casualty investigations and liability allocation. To ensure completeness and reduce procedural challenges, such records must be handled through standardized forensic processes, such as ISO/IEC 27037 [36]. In our case study, moving from an observed GNSS loss to a legally defensible attribution of RF interference depends on whether the underlying RF-layer record is preserved under a robust chain of custody. Accordingly, treating upstream RF captures as forensic-grade digital evidence allows independent parties to assess integrity and the claimed recording window without relying on narrative interpretation.

hypotheses, allowing investigators to re-analyze the physical layer even when bridge artifacts are ambiguous or their integrity is disputed. G2 Bind RF observations to onboard symptoms. The system must capture the minimal downstream context (e.g., NMEA sentences and receiver settings) contemporaneous to the RF capture. The contextual synchronization ensures the causal chain from external interference to the anomalies in onboard instrumentation remains auditable for investigators. G3 Produce a verifiable single record. The system must produce a SSoT bundle to provide an unbiased and complete evidence set for all stakeholders, satisfying the evidentiary weight requirements of both formal legal proceedings and forensic investigations (e.g., ISO/IEC 27037). This unified record ensures that integrity is independently checkable, preventing an interested party from performing an adversarial selection of logs (e.g., providing ECDIS data while omitting the RF context). G4 Provide verifiable time anchoring. The system must anchor the SSoT bundle to a specific timeframe using cryptographic checkpoints. This is necessary to prevent post-hoc manipulation and prove the temporal alignment between RF interference and system reactions (e.g., the 40 NM drift in Case Study 1), enabling objective liability assessment by third parties. Non-goals. We do not attempt attribution or prove intent. We do not interpret insurance coverage, exclusions, or legal causation, nor do we seek to favor any involved actor.

5

Related Work

Our work bridges the gap between forensic chain-of-custody, attestable logging, and RF security. While prior research treats these domains in isolation, we provide an integrated, forensicgrade pipeline that captures upstream RF observations alongside contemporaneous instrument context. This architecture ensures that both integrity and temporal claims are independently verifiable by third parties. Forensic acquisition methodologies and evidence handling. Digital forensics has long emphasized disciplined acquisition and preservation processes to reduce procedural challenges and increase reproducibility, as codified in standards such as ISO/IEC 27037 and operational guides such as NIST SP 800-86 [2, 42]. Recent work has also explored automatically verifiable acquisition in domains beyond classic disk/memory imaging; for example, WEFT proposes a methodology for collecting web evidence with built-in verification primitives [9]. In transportation, practitioner accounts

Goals. Accordingly, our methodology targets four goals designed to bridge the evidentiary gaps identified in the previous analysis: G1 Preserve upstream RF evidence. The system must capture coherent, multi-channel RF I/Q data rather than relying solely on downstream logs that only record symptoms (e.g., the ECDIS EP in Case Study 1). Such high-fidelity evidence enables the formal verification of RF attack 4

of event/voyage data recorder (EDR/VDR) forensics highlight that existing recorders are often (i) downstream-oriented, (ii) incomplete with respect to cyber-physical causality, and (iii) not designed for adversarial disputes around tampering or selective disclosure [10]. These observations motivate moving evidence collection closer to the upstream sources that determine what onboard systems perceive. Our methodology can be seen as a RF-native counterpart: it preserves raw RF (IQ) while binding it to the minimal context required to reconstruct what bridge systems observed, following a single “forensic envelope” abstraction rather than a collection of loosely coupled artifacts.

recovery under active spoofing [56], multi-sensor corroboration frameworks [15], and opportunistic external signals used as side channels [53]; maritime-specific GNSS considerations further expose operational constraints of shipborne receivers [71]. For AIS, seminal evaluations document protocollevel weaknesses and practical attack surfaces [6], while later work explores real-world spoofing case studies and systematic resilience testing of implementations [4, 43]. In aviation, empirical studies on safety-critical RF links (e.g., ILS and TCAS) underline that working attacks exist in realistic settings [48, 57], and “wireless witnessing” proposes distributed, independent observers to detect and corroborate manipulation in ADS-B-based surveillance [40]; large-scale measurement studies similarly emphasize the gap between perceived and actual security in aviation RF systems [64]. Collectively, these works motivate why RF evidence matters, but they are primarily oriented toward attack design, detection, or mitigation. Our contribution is complementary: we target post-incident reconstruction and adversarial scrutiny by preserving the upstream RF observations and binding them, verifiably, to the receiver/instrument state on which downstream systems acted .

Tamper-evident logging and trusted auditing. A core building block is the extensive line of work on tamper-evident audit logging. Early foundations formalize secure audit logs under compromise and post-hoc scrutiny assumptions, typically using hash chaining and key-evolution to ensure tamper evidence [60]. Subsequent work improves efficiency and verifiability, e.g., via tree-based structures enabling compact inclusion/consistency proofs over large logs [14], and via append-only schemes designed to remain robust under partial compromise [69]. Beyond cryptography-only approaches, systems research has leveraged trusted hardware to strengthen log integrity when the host OS is untrusted, including TEEbased log protection and practical trusted auditing frameworks [41, 54]. More recent storage-centric and large-scale approaches (e.g., tamper-evident storage layers and shareable accountability proofs for IoT-scale logging) address retention and proof distribution [44,63]. Our setting stresses these primitives in a distinct regime: high-rate, multi-stream RF sample capture with periodic trusted-time anchoring, where (a) the integrity object is not a low-rate event log but a sustained IQ stream, and (b) verifiability must cover both content integrity and claims about the recording window. Accordingly, we combine tamper-evident chaining with external time-stamping practices (e.g., RFC 3161 and related TSA operational requirements) to support third-party verification of temporal bounds [3, 74].

Maritime cybersecurity context. Finally, surveys and systematic reviews of maritime cybersecurity consistently identify GNSS and AIS as recurring high-impact dependencies within heterogeneous, legacy-heavy shipboard ecosystems [8, 12]. However, the literature largely treats evidence as an operational afterthought (e.g., VDR outputs and bridge logs), leaving a gap in forensic readiness when disputes hinge on what the receiver actually observed at the physical layer. Our work directly targets this gap by providing an evidence acquisition and verification pattern tailored to contested RF environments.

6

Methodology

6.1

Assumptions

RFbox clock initialization and drift. We assume that the RFbox clock is synchronized against a reliable reference in a trusted setting before each voyage (e.g., during harbor operations). After initialization, the clock operates in holdover mode without further synchronization. Specifically, we assume the system is equipped with a Stratum 3 [65] compliant high-precision Temperature Compensated Crystal Oscillator (TCXO) (e.g., SiTime SiT5356 [61]) providing ±0.1 parts per million (ppm) stability. This hardware choice limits the maximum theoretical drift to approximately 8.64 ms per day, resulting in a cumulative uncertainty of ε ≈ 0.26 s over a 30-day mission. Since ε remains well below the quantization threshold of standard filesystems (typically 1 s for POSIXcompliant file systems [11]), the accumulated drift is unlikely to compromise the causal ordering of the evidence.

Wireless deception and defense in navigation and situational awareness. A substantial body of security research demonstrates that RF manipulation in navigation and awareness systems is practical and increasingly sophisticated. For GNSS, classical analyses characterize the conditions under which spoofing succeeds and thereby separate realistic threats from toy demonstrations [66]; surveys systematize the resulting attack/defense space [59]. Follow-on work shows that attackers can pursue plausibility rather than obvious discontinuities (e.g., stealthy route-consistent manipulations), complicating post-incident interpretation from downstream logs alone [72]. Defensive techniques span single-receiver signal/constellation features [45], robust receiver designs and 5

Forensic envelope. The forensic envelope E , whose overall structure is depicted in Figure 1, is the final artifact of the acquisition process:

Trusted time source. We assume access to an RFC3161compliant TSA [74]. We assume its published signing certificate (or certificate chain) is the intended trust root, and that the TSA does not backdate tokens [17]. To timestamp an object x, the requestor computes a digest h ← algtsa (x), and submits a time-stamp request containing (algtsa , h). The TSA returns a time-stamp response that contains a signed Time-Stamp Token (TST) that cryptographically binds: (i) the message imprint (algtsa , h), (ii) a certified generation time τ, and (iii) the TSA identity, authenticated by the digital signature of the token and the TSA signing certificate. In the absence of external connectivity, we assume that RFbox can switch to an internal TSA. This authority leverages the onboard clock (see above) to generate the tokens. To maintain forensic transparency, the internal TSA flags the holdover state and populates the accuracy via standard RFC3161 fields. The latter represents the maximum temporal error ε, calculated as the sum of the initial synchronization offset and the cumulative drift (±0.1 ppm) since the last trusted harbor reference. SDR acquisition integrity. We assume the SDR acquisition has an attested baseline, similar to a measurement instrument. Under this assumption, the hardware delivers a baseband stream consistent with its documented deterministic processing, while device identifiers, firmware, and driver versions are recorded as protected metadata to ensure auditability. Specifically, we assume each SDR channel produces samples with a channel-local, monotonically increasing sample index. Any non-deterministic discontinuities, such as overruns or drops, are reported as explicit metadata events. Finally, we assume the factory-specified clock drift appears in the attested baseline.

6.2

E := ⟨B0 , {SCi }Ni=1 , SM , BE ⟩ where B0 is the initial block, SCi is the sequence of channel blocks Si for channel i, SM is the metadata-block sequence, and BE is the end-of-recording block. Each channel block sequence Sc has the following structure (c)

(c)

(c)

Sc := ⟨B1 , B2 , . . . , Bnc ⟩

c ∈ {1, . . . , N, M}.

Each persisted block B is a tuple B := ⟨seq, payload, σ⟩ where seq ∈ N is a strictly increasing sequence number within Sc (or −1 for B0 and BE ), payload is a typed payload, and σ is the block signature. For B0 and BE , σ is a TSA token. For all intermediate blocks, σ is a cryptographic hash linking the current block to the previous one. Concretely, for each stream c, we maintain a running value and update it as (c) (c) (c)
σi := algblk (σi−1 || enc(B̃i ) where B̃ is the unsigned part of the block, and enc(◦) is a canonical serialization. To seed each stream-specific chain, we bind it to the common start block and to the stream identifier:
(c) σ0 := algblk (B̃0 || enc(c)

6.3

Acquisition

We model acquisition as a protocol that, given an investigatorspecified configuration C , produces a tamper-evident forensic envelope E containing (i) coherent multi-channel IQ recordings and (ii) time-aligned contextual metadata, cryptographically sealed with trusted-time anchors.

Definitions

Configuration. An acquisition is specified by a configuration C

6.3.1

Architecture and data flows

An acquisition instance consists of four logical components.

C := ⟨N, NTSA , {Ci }Ni=1 ,CS,CD, algblk , algtsa ⟩

1. Coordinator. Owns the global case state, emits global control events, and handles investigator commands.

where: (i) N is the number of RF channels; (ii) NTSA is the checkpoint interval in seconds; (iii) each channel specifier Ci

2. Driver workers. One per SDR driver. Many SDR stacks serialize device access or expose non-thread-safe driver APIs [62]; we therefore isolate each backend behind a single device-owner worker that performs all driver I/O and fan-out.

Ci := ⟨idxi , sri , sbi , loi , drvi , cfgi , tpthi ⟩ includes a channel index idxi , sample rate sri , target block size sbi samples, center frequency loi , driver identifier drvi , driver-specific settings cfgi , and an optional temporary output directory tpthi ; (iv) CS is the final case storage directory; (v) CD is arbitrary case description data; (vi) algblk is the hash algorithm used for blocks; and (vii) algtsa is a TSA-supported digest.

3. Channel workers. One per RF channel. Each worker receives the channel’s IQ stream and in-band events, packetizes them into blocks, applies hash chaining, and persists the resulting block sequence SCi to a file under SC or at tpthc if set. 6

...

...

...

...

... ... Figure 1: Structure of the forensic envelope. 4. Metadata worker. Collects out-of-band context (e.g., NMEA sentences, decoded outputs, operator annotations), packetizes it into the metadata stream SM , and stores trusted-time checkpoints. SM is persisted to a file under SC or at tpthM if set.

or an equivalent hardware-timed start). The metadata worker stores a start of recording event MDsor , tagged with the wall-clock time. Intuitively, B0 commits to “what was intended to be recorded” (configuration) and “with which environment” (attestation), and binds these claims to an external time anchor before any samples are written.

Communication is via message passing: driver workers emit tuples ⟨c,ti , x⟩ where c is the channel identifier, ti is a channel-local sample index (or device timestamp convertible to such an index), and x is either an IQ segment or a metadata event. This design keeps channels independent: packetization, hashing, and I/O can proceed in parallel across channels, and (when available) can be placed on distinct storage devices to reduce contention. 6.3.2

6.3.3

Sample streaming

After the coordinated start, acquisition enters the sample streaming phase.

Initialization and start sealing

Channel workers. Each channel worker handles processing and persistence for a Sx . It incrementally aggregates IQ samples and in-band metadata received from metadata threads until accumulating at least the configured target block size sbc , then emits a block. Metadata events that arise within the SDR pipeline such as gain changes, overflows, device timestamps, sample index gaps, or receiver status updates produced by the acquisition stack are represented as interval events ⟨MD2 ,tbeg ,tend ⟩ in sample-index space. Payload for a block in Sx is thus x, {⟨MD,tbeg ,tend ⟩} , where x is a vector of IQ samples, followed by zero or more in-band metadata events.

Acquisition starts by preparing the SDR and attached devices for operation, crystallizing the acquisition context into the start block B0 , and time-stamping it. 1. Bring up and SDR preparation. The coordinator launches the sub-threads (driver/channel/metadata workers) and programs each SDR front-end with its perchannel parameters (drvi and loi ). 2. Freeze configuration and environment. B0 embeds the resolved configuration C , relevant device identifiers (e.g., serial numbers), and acquisition-host attestation material (e.g., a TPM quote) sufficient to later argue that a specific hardware/software stack produced the capture. B̃0 ’s contents are ⟨C , {MDu }Uu=1 ⟩, with every nonconfiguration information encoded within an arbitrary set of U key-value entries MDu = ⟨ku , vu ⟩.

Metadata worker. The metadata worker analogously emits to SM metadata blocks containing out-of-band events (e.g., NMEA sentences, operator notes, externally sourced WGS84 positions), each tagged with wall-clock time. Payload for a block pertaining to SM consists of one or more arbitrary keyvalue pairs, i.e., payload for a metadata block containing U entries is {MDu }Uu=1 .

3. Trusted-time anchor. The coordinator obtains a TST for B̃0 (TST0 ) which becomes the block signature of B0 . 4. Coordinated start. After persisting B0 , the coordinator arms streaming and releases capture on the next synchronization boundary (e.g., a PPS edge when available,

2 MD is an arbitrary key-value pair, as defined above.

7

6.3.4

6.4

Periodic Trusted-Time Checkpointing

Verification is a deterministic procedure that, for an envelope E , asserts (i) its unmodified status and (ii) its temporal span.

Hash chaining detects modification, truncation, and splicing, but does not bind data to a creation time. We therefore anchor the envelope to trusted time by embedding TSTs in B0 and BE and, for long captures, checkpointing the multi-stream head state every NTSA seconds during sample streaming. At checkpoint index j (with j increasing sequentially), the coordinator emits a checkpoint event that is picked up by all workers; upon receipt, each stream flushes any pending block(s), writes a snapshot request block with payload ⟨ j⟩ to its stream, and reports its current head descriptor. For stream c, the head is (c)

(c)

Verification

Inputs and trust assumptions. Verification takes as input the case directory containing E and a TSA trust root (certificate or chain) used to validate its signatures. All cryptographic parameters (e.g., algblk and algtsa ) are read from the start block B0 . Optionally, if the verifier is equipped to validate platform attestation material embedded in B0 (e.g., TPM quotes), it may additionally check that the acquisition host measurements match an expected policy.

(c)

H j = ⟨c, seq j , σ j ⟩,

Integrity verification checks. Validation of the integrity of E is performed by a verifier as follows:

where seq j denotes the latest block sequence number and

1. Start sealing. Load B0 , deserialize its unsigned payload B̃0 , and validate the TST against the TSA trust root by checking that it certifies algtsa (B̃0 ).

(c)

(c) σ j is the corresponding head digest; the metadata stream (M) contributes an analogous head H j . The coordinator then

2. Per-stream well-formedness and contiguity. For each stream c ∈ {1, . . . , N, M}, parse the block sequence Sc and check that: (i) every block deserializes; and (ii) sequence numbers are contiguous and unique, i.e.,  (c) (c) (c) B1 .seq = 1, Bi .seq = Bi−1 .seq + 1 | ∀i ∈

commits to the global state by forming the vector of heads  (1) (N) (M)  Hj = Hj ,...,Hj ,Hj and computing an aggregate digest

(c)

d j ← algtsa enc( j ∥ H j ) .

{2, . . . , nc } , and Bnc .seq = nc which implies no gaps and no duplicates.

The digest d j is submitted to the TSA, which returns TST j . Finally, the coordinator persists the checkpoint by sending a record ⟨ j, H j , TST j ⟩ to the metadata stream.

3. Per-stream hash-chain correctness. For each stream (c) c, recompute the stream seed σ̂0 ← algblk (B0 ∥ enc(c))

6.3.5

(c)

and then, for each block Bi ∈ Sc , recompute the chained digest

Stop and final checkpoint (c) (c) (c)
σ̂i ← algblk σ̂i−1 ∥ enc(B̃i ) ,

Upon receiving a termination request, the coordinator broadcasts a control event to all workers and waits for an orderly drain. Each channel worker and the metadata worker (i) flush any buffered samples/events, (ii) emit and persist any pending block(s), (iii) move the stream file from tpthc to CS (if defined), and (iv) return their terminating head descriptor (c)

(c)

(c)

HE = ⟨c, seqE , σE ⟩

(c)

(c)

rejecting if any stored link σi differs from σ̂i . 4. End sealing and manifest consistency. Load BE , deserialize B̃E , and validate its TST by checking that it certifies algtsa (B̃E ). Then verify that BE commits to the (c) (c) locally computed terminal heads ĤE = ⟨c, nc , σ̂nc ⟩ for all c.

c ∈ {1, . . . , N, M}

where seqE = nc is the last sequence number written for (c) stream c and σE is the corresponding head digest. The coordinator aggregates these heads into

5. TSA checkpoint (snapshot) anchors. Extract from the metadata stream the  ordered list of checkpoint records R = R1 , . . . , Rk , where R j = id j , H j , TST j  (1) (N) (M)  and H j = H j , . . . , H j , H j with per-stream heads

 (1) (N) (M)  HE = HE , . . . , HE , HE

H j = ⟨c, seq j , σ j ⟩. For each j ∈ {1, . . . , k}, check:

(c)

(c)

(c)

(c)

(a) Sequentiality of snapshot identifiers. Check that checkpoint IDs are contiguous and strictly increasing.

and constructs the end block BE . The unsigned payload B̃E commits to (i) HE , i.e., a snapshot of the last blocks of all streams, and (ii) an on-disk manifest that binds stream identifiers to their corresponding files. Finally, the coordinator obtains a TST for B̃E (TSTE ) and uses it as signature for BE .

min id ∈ {0/ 3 , 1}∧ ∀ j ∈ {2, . . . , k} : id j = id j−1 +1, 3 no snapshot is present.

8

4. No cross-stream or cross-case cut-and-paste (Check 3). Because each stream chain is seeded with both the common start block B0 and the stream identifier c, substituting a channel file with another channel’s file, or mixing blocks from a different case into the current case, breaks the recomputed chain and is detected during verification.

This rejects gaps, duplicates, and out-of-order snapshot identifiers. (b) TSA binding. Recompute the checkpoint digest dˆj ← algtsa (enc(id j ∥ H j )) and validate that TST j certifies exactly dˆj under the TSA trust root. Let τ j be the j-th token generation time. (c) Head consistency and monotonic progress. For each stream c, check that (i) head positions are (c) bounded and progress monotonically, 0 < seq1 < (c) · · · < seqk < nc , and (ii) the head digest matches (c)

(c)

the locally recomputed chain, σ j = σ̂

(c)

seq j

5. Consistent finalization and file binding (Check 4). The verified end block BE must commit to the locally (c) computed terminal heads HE for all streams. Hence, the verified case directory is internally consistent: the stream files, their identifiers, and their terminal states match exactly what was finalized at acquisition stop.

.

(d) On-stream checkpoint markers. For each stream (c) c, verify that block B (c) contains a checkpoint

6. Checkpoint record integrity (Check 5, if present). If periodic checkpoint records exist in SM , then their IDs are sequential, each TSA token binds exactly to the advertised vector of heads, and each head matches the verifier’s recomputed chain at the advertised position; moreover, on-stream markers pin checkpoints to the stream order. Thus, attempts to delete, insert, duplicate, reorder, or alter checkpoint records are detected.

seq j

marker for id j (and that such markers are unique within the block), ensuring that the checkpoint is pinned to the stream order. (e) Monotonicity of checkpoint times Check that τ0 ≤ τ1 ≤ · · · ≤ τk ≤ τE , where τ0 and τE are the generation times in B0 and BE .

Collectively, these properties mean that an integrity-verified envelope provides a single, internally consistent, tamperevident source of truth for the recorded RF samples and associated metadata, with any post-acquisition modification detectable by an independent verifier.

Integrity guarantees. We say that a forensic envelope E is integrity-verified if it passes the integrity verification checks. Under the cryptographic and trust assumptions in §6.1, acceptance implies the following properties, each corresponding directly to one or more of the checks.

Temporal span guarantees. If verification succeeds, the verifier obtains a sequence of externally vouched times. τ0 ≤ τ1 ≤ · · · ≤ τk ≤ τE Each checkpoint time τ j is tied to a validated multi-stream prefix expressed directly in block sequence numbers. Let I := {1, . . . , N, M} index the N RF streams and the metadata stream, and let s j be the head-position vector for a given TSA snapshot record R j ∈ R .  (c)      s j := seq j c∈I s0 := 0, . . . , 0 sE := nc c∈I

1. Endpoint sealing is authentic (Checks 1 and 4). The start block B0 and end block BE carry valid TSA timestamp tokens. Hence, any post-acquisition modification of the committed acquisition context B̃0 (e.g., configuration C and embedded environment/attestation material) or of the finalized envelope state B̃E (e.g., the committed terminal heads and manifest) is detected by TSA validation failure.

Because verification enforces contiguity and uniqueness of (c) sequence numbers within each stream, we can view seq j as selecting the unique terminal block of stream c at the checkpoint. We then define the induced multi-stream prefix E⪯s j as the tuple of per-stream prefixes D E (c) (c)  E⪯s j := B1 , . . . , B (c)

2. Per-stream well-formedness and contiguity (Check 2). For every stream c ∈ {1, . . . , N, M}, the parsed block sequence Sc is structurally well-formed and its sequence numbers are contiguous and unique. Consequently, the presented stream cannot contain undetectable gaps or duplicates at the block level.

seq j

3. Tamper-evident stream contents (Check 3). For every stream c, the verifier recomputes the seed and hash-chain links and requires exact agreement with the stored links. Therefore, any post-hoc modification of a block payload, deletion/insertion of blocks, or reordering/splicing within a stream changes at least one recomputed link and is rejected (except with negligible probability under the assumed hash security).

c∈I

By the per-stream hash-chain recomputation and the checkpoint head-consistency checks, the verifier has validated (c) (c) σ j = σ̂ (c) for all c ∈ I, and the on-stream marker check seq j

(c)

pins id j to the terminal block B

(c)

seq j

in each stream.

Moreover, the TSA binding check validates that T ST j certifies the digest d j at generation time τ j . Under a standard 9

no-backdating assumption for the TSA, each τ j therefore externally vouches that the concrete set of blocks whose sequence numbers are at most s j (i.e., E⪯s j ) existed no later than τ j ; analogously, τ0 vouches B0 and τE vouches the final envelope state committed in BE . This yields two practically useful statements.

concatenation, (c)

(c)

(c)

where xi denotes the sample vector carried in the payload of (c) block Bi . In-band metadata entries stored alongside samples (e.g., gain changes, device-timestamp reports) are indexed in sample space and are replayed deterministically at their recorded sample indices. When an in-band event indicates a known discontinuity in the SDR sample counter (e.g., an overflow), the player preserves the original timeline by inserting a synthetic “gap” segment of the corresponding duration before continuing with the next recorded samples; this keeps subsequent in-band events aligned in sample-index space under the monotonic sample indexing assumption.

1. Non-backdating beyond anchors. The acquisition context committed in B0 existed no later than τ0 , and the fully finalized envelope state (including all stream terminations) existed no later than τE . 2. Bounded backdating within the case. For each checkpoint id j, all samples and metadata covered by the committed heads H j existed no later than τ j . With checkpoints spaced every NT SA seconds, any attempt to shift the claimed occurrence time of an RF event by more than the checkpoint granularity requires either modifying a checkpoint record or recomputing a committed head, both of which are detected by the above checks.

6.5

(c)

x(c) := x1 ∥x2 ∥ · · · ∥xnc

Cross-channel coherence. Let src be the sample rate for channel c. Playback schedules transmission using a common hardware-timed start at time tstart . Concretely, for each channel c and sample index k ≥ 0, the intended transmit time is

Playback

t (c) (k) := tstart +

Playback re-emits a integrity-verified forensic envelope E into SDR transmit hardware to reproduce the recorded RF observation under hardware-in-the-loop conditions. Unlike offline reprocessing (which consumes the stored IQ directly), playback is intended to (i) exercise real receivers and bridge equipment, and (ii) preserve the original timing relationships across bands and between RF and auxiliary telemetry.

k src

When the SDR provides a shared timebase across TX chains, using the same tstart for all c preserves the relative phase relationships captured during acquisition. Metadata replay. The metadata stream SM carries out-ofband events tagged with wall-clock time. The metadata replayer schedules each event at the same relative offset from the beginning of the capture, i.e., an event with recorded wallclock time t j is emitted at local time tstart + (t j − tref ), where tref is the wall-clock annotation recorded in the first metadata record emitted after B0 , i.e. MDsor . Under the stable local wall clock assumption, events played back as such do preserve the temporal relationships they had during acquisition.

Inputs and preconditions. Playback takes as input the case directory E and an investigator-specified mapping   containing   µ : c c∈I → ĉ ĉ∈I from recorded channels to SDR transmit chains. From B0 , the player reconstructs the resolved configuration C , including per-channel (loi , sri ) and the driver settings needed to reproduce the sample format and front-end configuration.

7

Architecture. A coordinator thread configures hardware and controls start/stop. For each stream c ∈ 1, . . . , N, a stream reader sequentially reads blocks and pushes their sample payloads into a bounded queue. One TX worker is instantiated per SDR driver backend; it pulls from the queues of the channels it owns and performs all driver I/O. A separate metadata replayer consumes SM and delivers auxiliary events (e.g., NMEA sentences, operator annotations, externally sourced positions) to investigator-selected sinks.

Evaluation

We quantify the resource overhead introduced by our forensically sound acquisition pipeline, relative to a minimal baseline that only persists raw samples. Our goal is to isolate the cost of envelope construction (serialization, hashing, and metadata handling) under representative multi-band acquisition workloads. We do not evaluate waveform fidelity or decoder output quality. Under our assumptions, fidelity is a property of the SDR hardware and its driver, and both the baseline and our system exercise the same capture and replay primitives. All experiments run on a workstation equipped with an AMD Ryzen 7900 CPU. Our prototype is implemented in Rust [55] and uses BLAKE3 [52] as its algblock , SHA-256 for algTSA , OpenSSL as TSA, and FlatBuffers [19] for enc(◦).

Deterministic stream reconstruction. Each channel c is represented as an ordered, gap-free sequence of blocks, and the envelope records terminal heads in BE . Consequently, playback reconstructs a unique contiguous IQ sequence by 10

CPU ratio

Table 1: Protocol presets and acquisition profiles used in the evaluation. Profiles are subsets recorded concurrently.

2.5 2.0 1.5 1.0

Protocol presets (single-channel)

ALL

fc [MHz]

B [MHz]

fs [MS/s]

AIS_a AIS_b VHF GPS_L1 GPS_L2 GPS_L5 GALILEO_E1 GALILEO_E5a GALILEO_E5b GALILEO_E6

161.975 162.025 159.000 1575.420 1227.600 1176.450 1575.420 1176.450 1207.140 1278.750

[37] 0.025 [37] 0.025 [1] 3.100 [38] 2.046 [38] 2.046 [38] 20.460 [5] 24.552 [5] 20.460 [5] 20.460 [5] 40.920

0.030 0.030 3.720 2.455 2.455 24.552 29.462 24.552 24.552 49.104

AIS

GALILEO

GNSS

GPS

VHF

Figure 2: ρR for CPU usage. HDD ratio

Protocol

1.03225 1.03210 1.03195 1.03180 1.03165

1.0006 1.0005 1.0004 1.0003 1.0002 AIS

ALL

GALILEO

GNSS

GPS

VHF

Figure 3: ρR for storage usage.

Acquisition profiles (multi-channel) Profile

#ch.

Composition

∑ fs [MS/s]

AIS VHF GPS GALILEO GNSS ALL

2 1 3 4 7 10

AIS_a, AIS_b VHF GPS_L1, GPS_L2, GPS_L5 E1, E5a, E5b, E6 GPS ∪ GALILEO all presets above

0.060 3.720 29.462 127.670 157.133 160.913

we normalize the forensic pipeline by the baseline: ρR :=

For E3 we measure CPU utilization, RAM usage, and the verification speed w.r.t. realtime.

7.2 We construct representative acquisition presets that emulate full-band capture for a set of maritime-relevant protocols spanning narrowband VHF (AIS) to wideband GNSS signals. Each protocol preset is defined by a center frequency fc and a nominal occupied bandwidth B. We emulate a full-spectrum recording for that band by selecting a complex sample rate fs = (1 + γ) B with γ = 0.2, i.e., a 20% guard band over B. Then, we define profiles as subsets of presets that are acquired concurrently (one logical channel per protocol). Table 1 summarizes both the per-protocol presets and the evaluated profiles. Each channel reads samples from a deterministic tone generator producing SC8 IQs at rate fs . To exclude I/O bottlenecks while still measuring output size, all writes happen to a memory-backed filesystem. For each of the 6 profiles in Table 1, we record 60 s and repeat each experiment 25 times.

7.1

Rforensic Rbaseline

Results

Table 2: Footprint of forensic acquisition and verification. Profile

CPU [%/core]

Disk [MB/s]

Acq. mem [MB]

Ver. mem [MB]

AIS VHF GPS GALILEO GNSS ALL

0.20 5.67 32.89 106.35 145.33 147.97

0.12 7.44 58.92 255.34 314.27 321.86

5.41 6.68 11.3 14.5 21.5 24.7

0.83 5.61 13.8 18.8 29.6 33.2

Table 2 displays for each profile its associated overall CPU usage, disk throughput, acquisition, and verification RAM usage. In aggregate, the most demanding profiles consume the equivalent of approximately 1.5 CPU cores. Disk throughput peaks at ≈ 322 MB/s, while memory stays below ≈ 25 MB during acquisition and below ≈ 40 MB during verification. Figure 2 shows the CPU ratio w.r.t. baseline. Across profiles, the overhead is typically around 1.2–1.3×, with the largest observed excursion reaching ≈ 2.5× on the GNSS profile. Figure 3 shows the storage size, showing a negligible increase (at most ≈ 3%) compared to the baseline. Figure 4 depicts the memory usage ratio of the forensically sound pipeline w.r.t. the baseline, ranging from a near-baseline footprint in the AIS case (≈ 1.2×) up to ≈ 5.3× when all streams are enabled. Figure 5 shows the verifier memory usage, which stays below ≈ 40 MB (peaking at ≈ 38 MB) even when all streams are validated together. Figure 6 shows the Cumulative Distribution Function (CDF) of the verifier speeds w.r.t. the length of the acquisition. Verification ranges from ≈ 15×– 50× faster than realtime on the wideband profiles up to ≈

Experiments

Three experiments were conducted for each profile, as follows. (E1 ) Baseline (raw recording). We append the generated samples to file(s) without any additional processing, approximating the minimal cost of persisting the sample stream. (E2 ) Forensic pipeline. We run the full acquisition pipeline described in the paper. (E3 ) Verification (after E2 ). We run our verifier over the produced envelope. For E1 and E2 we measure: (i) CPU utilization, (ii) RAM usage, and (iii) disk space consumption. For each resource R, 11

Memory ratio

makes it substantially harder for any single party to retroactively shift the claimed time of RF events without detection. The operational cost is dependence on connectivity when requesting timestamp tokens. In practice, vessels may have intermittent satellite links, and adversaries capable of RF interference may also impede the backhaul used to reach the TSA. When a request is delayed, the resulting token still certifies the envelope state, but only at the later token time; this weakens the backdating bound to “no later than when connectivity resumed”, enlarging the window in which a malicious party could claim an earlier occurrence time. Our local TSA service eliminates reliance on the Internet and provides internal consistency: it attests to a time value coherent with the platform’s time base and signs checkpoint digests at high cadence. However, this does not provide an external attestation of time. The trust model collapses to that of the shipboard acquisition/VDR domain: a third party must trust that the local signer is correctly configured, uncompromised, and not backdating. This posture is analogous to how shipboard recorders are typically treated in proceedings, i.e., the device self-attests its time base. Admissibility then depends on demonstrating correct configuration and absence of tampering, rather than on an independent time authority.

5 4 3 2 1 ALL

AIS

GALILEO

GNSS

GPS

VHF

CDF

Figure 4: ρR for memory usage. 1.00 0.75 0.50 0.25 0.00

AIS ALL GALILEO GNSS GPS VHF

0

5

10

15

20

25

30

35

Verification memory usage [MB]

Figure 5: Memory usage CDF during verification. 1000× faster than realtime on AIS, slowing down roughly with the aggregate sample rate reported in Table 1.

8

Discussion

Performance considerations. Overall, the measurements indicate that making the capture verifiable is inexpensive relative to the intrinsic cost of recording high-rate IQ streams. Across all profiles, the forensic pipeline adds negligible storage overhead (worst case ≈ 3%) and significant yet bounded CPU overhead (at most ≈ 2.5× baseline but less than 2 CPU cores overall), suggesting that serialization and hash chaining are not the throughput bottleneck. The apparent memory inflation is best interpreted in absolute terms: while the memory ratio can rise substantially, acquisition remains below ≈ 25 MB and verification stays below ≈ 40 MB, even when validating all streams together. Verification is also practical for third parties: it runs from an order of magnitude to hundreds of times faster than real time, scaling primarily with aggregate sample volume. Taken together, these results shift the deployment constraint away from cryptography and toward I/O: the heaviest profile sustains ≈ 322 MB/s of writes, so provisioning dedicated high-throughput storage (and avoiding contention with other logging tasks) is the dominant engineering requirement, not the integrity layer itself.

Continuous operation. Full-fidelity IQ acquisition is storage-intensive and, at first sight, appears costly and impossible to implement on commodity shipboard systems. Even for multi-band, multi-channel settings, modern disks can sustain tens to hundreds of MB/s sequential writes, and commodity CPUs can hash at multi-GB/s rates using modern primitives, as reflected in our experimental results. As such, such a system is within the realm of possibility. These trends enable an operationally attractive mode: a certified ring buffer of acquisitions. The key observation is that the cryptographic overhead is small compared to sample volume, and the compute cost is dominated by streaming hashes and serialization, both of which map well to today’s CPUs. The remaining practical constraint is I/O provisioning (dedicated disks, avoiding contention with other VDR workloads), which is an engineering consideration rather than a fundamental barrier.

Trusted time anchoring: TSA choice and the resulting guarantees. The envelope’s integrity properties (tamper evidence, contiguity, cross-stream binding) follow from hash chaining and endpoint sealing. However, temporal guarantees, i.e., how strongly an external party can bound backdating, are shaped by the deployed TSA model and by connectivity assumptions. Binding periodic checkpoints to an external RFC3161compliant TSA yields the cleanest evidentiary story: timestamp tokens are verifiable under a public trust root and (under our assumptions) provide an external “no-later-than” bound for the committed envelope state at each checkpoint. This

What we certify (and what we do not). The envelope provides strong guarantees against post-acquisition tampering: an independent verifier can detect modification, truncation, reordering, cross-stream swapping, and (with TSA anchors) bound backdating at the checkpoint granularity. This does not imply that the recorded RF signals were “actually there” in the physical world, nor that the SDR stack was honest at acquisition time. In other words, we certify that “this is exactly what the recorder stored”, not that “this is exactly what the ether contained”. The distinction matters because an adversarial operator (or compromised acquisition host) could in principle: (i) inject synthetic IQ into the recording path, (ii) 12

CDF

ALL

1.00 0.75 0.50 0.25 0.00 20

AIS

30

1000

1250

GALILEO

1500

20

30

GNSS

40

20

25

30

GPS

35

20

30

VHF

40

50

100

150

200

Verification speed w.r.t. realtime

Figure 6: Verification speed w.r.t. realtime. Generalized formulation. Although we focus on the maritime use case, the methodology itself is not maritime-specific: it is a protocol and domain-agnostic evidence pattern for any setting where (i) safety/security outcomes depend on wireless signals, (ii) disputes hinge on what the receiver actually observed (including physical-layer artifacts), and (iii) third parties must be able to reproduce analyses under a verifiable chain of custody. Examples include: aviation (GNSS interference [66], ADSB/TCAS anomalies [13,49], VHF navigation/communications disputes [58, 64]), intelligent transportation (GNSS and V2X manipulation affecting automated or assisted driving [16,22,73]), industrial and critical infrastructure (wireless sensor/actuator networks, private LTE/5G links, microwave backhaul), and public-safety or enterprise environments (coverage, jamming, or spoofing allegations in incident response [67]).

manipulate driver/firmware settings while reporting benign metadata, or (iii) record from an alternative antenna/frontend. Our methodology already anticipates this by allowing attestation material to be embedded within CD within B0 , but meaningful authenticity at acquisition time ultimately requires defense-in-depth: secure boot for the host, signed SDR firmware where available, measured driver stacks, physical tamper resistance, and (ideally) redundant sensing (e.g., independent receivers or dissimilar chipsets) to make fabrication detectable via inconsistency. These measures strengthen the instrument model but do not eliminate the conceptual gap between “recorded” and “physically observed”.

Integrating RF capture in VDRs A central goal of the methodology is to bind raw RF to the instrument state that navigators and downstream systems acted upon (decoded outputs, NMEA sentences, receiver status, alarms). In practice, these metadata feeds already traverse the ship’s sensor networks and are consumed by VDRs. This suggests a natural integration path: the metadata worker should be implemented as a first-class VDR function (or a tightly coupled module), rather than an external add-on. Embedding RF acquisition into VDRs has two advantages. First, it reduces integration friction by reusing standardized sensor interfaces and existing retention policies. Second, it aligns the physical custody story with existing regulatory practices for crash-protected recording systems. The main engineering challenge is disk bandwidth: conventional VDR inputs are orders of magnitude smaller than wideband IQ. As such, designing a hypothetical VDR with these features would be a complete redesign rather than the mere addition of another data stream.

9

Conclusion

We presented a forensically sound methodology to acquire maritime wireless evidence by capturing coherent multichannel RF alongside time-aligned instrument-state metadata, and packaging both into a single verifiable envelope. The envelope’s hash chaining and trusted-time anchoring make post-acquisition tampering and disputed timing claims independently checkable, improving dispute resilience in investigations and claims handling. Our prototype evaluation shows the approach is practical at operationally realistic rates, with modest overhead compared to raw recording. This provides a concrete path to reconstructing contested RF incidents from upstream observations rather than relying on fragile downstream logs alone.

Operational failure modes. High-rate acquisition inevitably faces overload conditions (I/O stalls, overruns). The design choice to represent discontinuities as explicit in-band metadata is essential: it makes loss visible and therefore debatable, rather than silently biasing reconstructions. Still, in adversarial settings, dropped samples could be overzealously interpreted as the selective suppression of evidence. This can be mitigated by failing acquisition on such events. 13

Ethical Considerations

store them under strict access controls, and follow established chain-of-custody procedures. Sharing should be limited to authorized parties and governed by legal process and confidentiality agreements. Selective disclosure limitations: our integrity construction is optimized for whole-record verifiability; this can make “reveal only the relevant minutes” difficult without exposing additional context. When partial disclosure is necessary, evidence should be shared via trusted escrow (e.g., court-appointed experts, as already customary in legal proceedings). Playback safety: although we describe playback for controlled reconstruction and hardware-in-the-loop testing, any transmission of recorded signals must be confined to shielded/cabled environments or otherwise compliant with radio regulations. Playback should not be used over-the-air in operational bands.

The acquisition workflow is passive (receive-only): it does not transmit RF energy, probe remote systems, or otherwise interact with third-party infrastructure during recording. Our evaluation does not rely on capturing over-the-air communications; instead, we use synthetic IQ streams generated locally. Stakeholders. We consider the following stakeholders and impacts. (i) Vessel operators/crew and shipowners (potential victims) benefit from improved forensic readiness: the ability to produce a verifiable, independently auditable record can reduce wrongful liability and support safety investigations when RF interference is suspected. (ii) Investigators, insurers, and courts benefit from a reproducible evidence artifact that reduces disputes about integrity, completeness, and timing, and that discourages selective log curation. (iii) Third parties whose transmissions may be incidentally captured (e.g., nearby vessels, coastal stations, or other spectrum users) may face privacy and confidentiality risks if recordings include communications beyond what is necessary for incident analysis. (iv) Adversaries may be hindered by increased accountability and improved post-hoc scrutiny, but may also attempt to misuse the tooling for surveillance or to strengthen record-and-replay capabilities. (v) The research team is not exposed to human-subject risks in this study, as we do not collect personal data from human participants and do not run experiments on live third-party systems.

Ethical principles and decision to publish. Under the Menlo principles: Beneficence is served by improving safety investigations and reducing incentives/opportunities for evidence tampering; Respect for Persons motivates minimizing incidental collection and enforcing strict confidentiality controls; Justice is served by producing a single verifiable record that reduces asymmetric evidentiary power; and Respect for Law and Public Interest requires that any real-world deployment comply with applicable spectrum and interception laws and established forensic practice. We judge that the expected defensive and accountability benefits outweigh the residual risks, provided deployments follow the mitigations above and treat RF captures as sensitive evidence rather than generalpurpose telemetry.

Potential harms and dual-use concerns. The primary ethical risk arises from the nature of raw RF capture: depending on front-end configuration (bandwidth, antenna placement, and channel selection), recordings can unintentionally include sensitive content (e.g., voice or other non-target transmissions), or enable downstream extraction of information not needed for the forensic question at hand. A second risk is dual use. While SDR capture and replay are already well known, packaging and verification primitives could lower the operational friction for adversarial collection, sharing, and replay of RF data. Moreover, the multi-party nature of insurance/legal disputes can pressure parties into sharing more raw data than strictly necessary, potentially expanding exposure. Mitigations. We mitigate these risks through responsible use constraints for the system. Data minimization: deployments should restrict acquisition to the narrowest frequency bands and bandwidths needed to answer the forensic question (e.g., AIS channels and relevant GNSS bands), avoiding broad-spectrum or opportunistic recording. Configuration is explicit and auditable (as captured in the start block), enabling third parties to verify what was intended to be recorded. Evidence handling and access control: raw RF envelopes should be treated as sensitive forensic evidence. Operators should 14

References

[11] Brian Carrier. File System Forensic Analysis. AddisonWesley Professional, Boston, MA, 2005.

[1] Interim solutions for improved efficiency in the use of the band 156–174 MHz by stations in the maritime mobile service. Recommendation ITU-R M.1084-5, International Telecommunication Union, Radiocommunication Sector (ITU-R), Geneva, March 2012.

[12] Maria Valentina Clavijo Mesa, Carmen Elena PatinoRodriguez, and Fernando Jesus Guevara Carazas. Cybersecurity at sea: A literature review of cyber-attack impacts and defenses in maritime supply chains. Information, 15(11):710, November 2024.

[2] Iso/iec 27037:2012 information technology — security techniques — guidelines for identification, collection, acquisition and preservation of digital evidence. International Standard, 2012. Edition 1.

[13] Andrei Costin, Aurélien Francillon, et al. Ghost in the air (traffic): On insecurity of ads-b protocol and practical attacks on ads-b devices. black hat USA, 1:1–12, 2012.

[3] Etsi en 319 421 v1.2.1: Policy and security requirements for trust service providers issuing time-stamps. European Standard, May 2023. ETSI EN 319 421 V1.2.1 (2023-05).

[14] Scott A. Crosby and Dan S. Wallach. Efficient data structures for tamper-evident logging. In Proceedings of the 18th USENIX Security Symposium (USENIX Security ’09). USENIX Association, 2009.

[4] Andrej Androjna, Marko Perkovič, Ivica Pavić, and Jakša Mišković. Ais data vulnerability indicated by a spoofing case-study. Applied Sciences, 11(11):5015, 2021.

[15] Sagar Dasgupta, Mizanur Rahman, Mhafuzul Islam, and Mashrur Chowdhury. A sensor fusion-based gnss spoofing attack detection framework for autonomous vehicles. IEEE Transactions on Intelligent Transportation Systems, 23(12), 2022.

[5] J. A. Ávila Rodríguez. Galileo signal plan. Navipedia (European Space Agency), 2011.

[16] Sagar Dasgupta, Mizanur Rahman, Mhafuzul Islam, and Mashrur Chowdhury. A sensor fusion-based gnss spoofing attack detection framework for autonomous vehicles. IEEE Transactions on Intelligent Transportation Systems, 23(12):23559–23572, 2022.

[6] Marco Balduzzi, Alessandro Pasta, and Kyle Wilhoit. A security evaluation of ais automated identification system. In Proceedings of the 30th Annual Computer Security Applications Conference (ACSAC ’14). ACM, 2014.

[17] ETSI. Electronic signatures and infrastructures (esi); policy and security requirements for trust service providers issuing time-stamps. ETSI EN 319 421 V1.3.1 (2025-05), European Telecommunications Standards Institute (ETSI), May 2025.

[7] BIMCO, CLIA, ICS, INTERCARGO, INTERTANKO, OCIMF, and WSC. The guidelines on cyber security onboard ships. Technical report, BIMCO, Bagsvaerd, Denmark, November 2024.

[18] Ettus Research. USRP Hardware Driver and USRP Manual - 4.9 - Device Synchronization. https://uhd.readthedocs.io/en/uhd-4.9/page_sync.html.

[8] Victor Bolbot, Ketki Kulkarni, Päivi Brunou, Osiris Valdez Banda, and Mashrura Musharraf. Developments and research directions in maritime cybersecurity: A systematic literature review and bibliometric analysis. International Journal of Critical Infrastructure Protection, 39:100571, December 2022.

[19] FlatBuffers Contributors. https://flatbuffers.dev/.

Flatbuffers.

[20] Gard. Shipowners – P&I (Protection and Indemnity). https://gard.no/products-and-services/ products/shipowners/shipowners-p-and-i/. Accessed: 2026-01-17.

[9] Alessandro Cantelli-Forti, Giacomo Longo, Francesco Lupia, and Enrico Russo. Weft: a consistent and tamperproof methodology for acquisition of automatically verifiable forensic web evidence. International Journal of Information Security, 24, February 2025. Article number 81.

Gps interference in geopolitical con[21] Gard. flict zones. https://gard.no/insights/ gps-interference-in-geopolitical-conflict-zones/, July 2025. Accessed: 2026-01-17.

[10] Alessandro Cantelli-Forti, Giacomo Longo, Amir Hosein Oveis, and Enrico Russo. Insights from field experience: digital forensics of event and voyage data recorders in transportation systems accident investigation. International Journal of Information Security, 24, June 2025. Article number 163.

[22] Monowar Hasan, Sibin Mohan, Takayuki Shimizu, and Hongsheng Lu. Securing vehicle-to-everything (v2x) communication platforms. IEEE Transactions on Intelligent Vehicles, 5(4):693–713, 2020. 15

[23] Institute Clauses. Institute cyber attack exclusion clause (cl.380), 10/11/2003. https://www.pminsurancebrokers.com/wpcontent/uploads/marineclauses/CL380.pdf, November 2003. Accessed: 2026-01-17.

[31] International Maritime Organization. Resolution MSC.192(79): Adoption of the Revised Performance Standards for Radar Equipment. https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ MSCResolutions/MSC.192%2879%29.pdf, 2004. Adopted: 6 December 2004. Accessed: 2026-01-26.

[24] Institute of London Underwriters. Institute time clauses – hulls (1/10/83). Market Clause CL. 280. Distributed by the International Underwriting Association (IUA), 1983.

Resolution [32] International Maritime Organization. msc.255(84): Adoption of the code of the international standards and recommended practices for a safety investigation into a marine casualty or marine incident (casualty investigation code). PDF, May 2008. Accessed: 2026-01-17.

[25] Institute of London Underwriters. Institute war and strikes clauses – hulls-time (1/10/83). Market Clause CL. 281. Distributed by the International Underwriting Association (IUA), 1983. [26] International Electrotechnical Commission. IEC 611621:2016. Maritime Navigation and Radiocommunication Equipment and Systems—Digital Interfaces—Part 1: Single Talker and Multiple Listeners. https:// webstore.iec.ch/publication/24227, 2016. Accessed: 2026-01-26.

[33] International Maritime Organization. Resolution MSC.333(90): Adoption of Revised Performance Standards for Shipborne Voyage Data Recorders (VDRs). https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ MSCResolutions/MSC.333%2890%29.pdf, 2012. Accessed: 2026-01-26.

Resolution [27] International Maritime Organization. MSC.64(67): Adoption of New and Amended Performance Standards for Navigational Equipment. https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ MSCResolutions/MSC.64(67).pdf, 1996. Accessed: 2026-01-25.

[34] International Maritime Organization. Resolution MSC.401(95): Performance Standards for Multisystem Shipborne Radio Navigation Receivers. https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ MSCResolutions/MSC.401%2895%29.pdf, 2015. Adopted: 11 June 2015. Accessed: 2026-01-26.

[28] International Maritime Organization. Resolution MSC.74(69): Adoption of New and Amended Performance Standards (Annex 1: Recommendation on Performance Standards for Shipborne Combined GPS/GLONASS Receiver Equipment). https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ MSCResolutions/MSC.74%2869%29.pdf, 1998. Adopted: 12 May 1998. Accessed: 2026-01-26.

[35] International Maritime Organization. Resolution MSC.530(106): Performance Standards for Electronic Chart Display and Information Systems (ECDIS). https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ 2022. MSCResolutions/MSC.530%28106%29.pdf, Adopted: 7 November 2022. Accessed: 2026-01-26. [36] International Organization for Standardization and International Electrotechnical Commission. Iso/iec 27037:2012: Guidelines for identification, collection, acquisition, and preservation of digital evidence. https: //www.iso.org/standard/44381.html, 2012. Accessed: 2026-01-17.

[29] International Maritime Organization. International convention for the safety of life at sea (SOLAS), chapter V: Safety of navigation, regulation 19: Carriage requirements for shipborne navigational systems and equipment. https://assets.publishing.service. gov.uk/media/5a7f0081ed915d74e33f3c6e/ solas_v_on_safety_of_navigation.pdf, 2000. Accessed: 2026-01-25.

[37] International Telecommunication Union. ITUR M.1371-5. Technical characteristics for an automatic identification system using time division multiple access in the VHF maritime mobile frequency band. https://www.itu.int/rec/R-REC-M. 1371-5-201402-I/en, 2014. Accessed: 2026-01-26.

[30] International Maritime Organization. Resolution MSC.192(79): Adoption of the Revised Performance Standards for Radar Equipment. https://wwwcdn.imo.org/localresources/ en/KnowledgeCentre/IndexofIMOResolutions/ MSCResolutions/MSC.192(79).pdf, 2004. Accessed: 2026-01-25.

[38] International Telecommunication Union, Radiocommunication Sector (ITU-R). Description of systems and networks in the radionavigation-satellite service (space-toearth and space-to-space) and technical characteristics of 16

transmitting space stations operating in the bands 1 164– 1 215 mhz, 1 215–1 300 mhz and 1 559–1 610 mhz. Recommendation ITU-R M.1787-5, International Telecommunication Union, Geneva, July 2024.

[49] Giacomo Longo, Martin Strohmeier, Enrico Russo, Alessio Merlo, and Vincent Lenders. On a collision course: Unveiling wireless attacks to the aircraft traffic collision avoidance system (tcas). In 33rd USENIX Security Symposium (USENIX Security 24), pages 6131– 6147, 2024.

[39] International Underwriting Association of London. IUA Clauses Document Library System. https://www.iua. co.uk/, 2026. Accessed: 2026-01-26.

[50] John Lyle and Andrew Martin. Trusted computing and provenance: Better together. Usenix, 2010.

[40] Kai Jansen, Liang Niu, Nian Xue, Ivan Martinovic, and Christina Pöpper. Trust the crowd: Wireless witnessing to detect attacks on ads-b-based air-traffic surveillance. In Network and Distributed System Security Symposium (NDSS) 2021. Internet Society, 2021.

Container vessel MSC An[51] MarineTraffic News. tonia grounded in Red Sea: GPS spoofing suspected. https://www.marinetraffic.com/ en/maritime-news/14/accidents/2025/12071/ container-vessel-msc-antonia-grounded-in-red-sea-gpsJanuary 2025. Accessed: 2026-02-05.

[41] Vishal Karande, Erick Bauman, Zhiqiang Lin, and Latifur Khan. Sgx-log: Securing system logs with sgx. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security (AsiaCCS ’17). ACM, 2017.

[52] Jack O’Connor, Jean-Philippe Aumasson, Samuel Neves, and Zooko Wilcox-O’Hearn. BLAKE3: one function, fast everywhere. https://github.com/BLAKE3team/BLAKE3-specs/blob/master/blake3.pdf, 2021. Version 20211102173700.

[42] Karen Kent, Suzanne Chevalier, Tim Grance, and Hung Dang. Guide to integrating forensic techniques into incident response. NIST Special Publication 800-86, National Institute of Standards and Technology, August 2006.

[53] Gabriele Oligeri, Savio Sciancalepore, and Roberto Di Pietro. Gnss spoofing detection via opportunistic iridium signals. In Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec ’20). ACM, 2020.

[43] Syed Khandker, Hannu Turtiainen, Andrei Costin, and Timo Hämäläinen. Cybersecurity attacks on software logic and error handling within ais implementations: A systematic testing of resilience. IEEE Access, 10:29493– 29505, 2022.

[54] Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, and Dave Tian. Custos: Practical tamper-evident auditing of operating systems using trusted execution. In Network and Distributed System Security Symposium (NDSS) 2020. Internet Society, 2020.

[44] David Koisser and Ahmad-Reza Sadeghi. Accountability of things: Large-scale tamper-evident logging for smart devices. arXiv, 2023.

[55] Rust Contributors. Rust. https://rust-lang.org/.

[45] Shinan Liu, Xiang Cheng, Hanchao Yang, Yuanchao Shu, Xiaoran Weng, Ping Guo, Kexiong (Curtis) Zeng, Gang Wang, and Yaling Yang. Stars can tell: A robust method to defend against gps spoofing attacks using offthe-shelf chipset. In Proceedings of the 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2021.

[56] Harshad Sathaye, Gerald LaMountain, Pau Closas, and Aanjhan Ranganathan. Semperfi: Anti-spoofing gps receiver for uavs. In Network and Distributed System Security Symposium (NDSS) 2022. Internet Society, 2022. [57] Harshad Sathaye, Domien Schepers, Aanjhan Ranganathan, and Guevara Noubir. Wireless attacks on aircraft instrument landing systems. In 28th USENIX Security Symposium (USENIX Security 19), pages 357– 372. USENIX Association, August 2019.

[46] Lloyd’s Market Association. Marine cyber exclusion clause (lma5403). LMA Standard Wordings, 2019. [47] Lloyd’s Market Association. LMA Lloyd’s Wordings Repository. https://lmalloyds.com/, 2026. Accessed: 2026-01-26.

[58] Harshad Sathaye, Domien Schepers, Aanjhan Ranganathan, and Guevara Noubir. Wireless attacks on aircraft instrument landing systems. In 28th USENIX Security Symposium (USENIX Security 19), pages 357– 372, 2019.

[48] Giacomo Longo, Martin Strohmeier, Enrico Russo, Alessio Merlo, and Vincent Lenders. On a collision course: Unveiling wireless attacks to the aircraft traffic collision avoidance system (tcas). In 33rd USENIX Security Symposium (USENIX Security 24), pages 6131– 6147. USENIX Association, August 2024.

[59] Desmond Schmidt, Kenneth Radke, Seyit A. Camtepe, Ernest Foo, and Ming Ren. A survey and analysis of the gnss spoofing threat and countermeasures. ACM Computing Surveys, 48(4):1–31, May 2016. 17

[60] Bruce Schneier and John Kelsey. Secure audit logs to support computer forensics. ACM Transactions on Information and System Security, 2(2):159–176, May 1999.

[72] Kexiong (Curtis) Zeng, Shinan Liu, Yuanchao Shu, Dong Wang, Haoyu Li, Yanzhi Dou, Gang Wang, and Yaling Yang. All your gps are belong to us: Towards stealthy manipulation of road navigation systems. In Proceedings of the 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, 2018.

[61] SiTime Corporation, Santa Clara, CA, USA. SiT5356 Datasheet: 1–60 MHz, ±0.1 to ±0.25 ppm, Stratum 3 Precision TCXO, rev. 1.8 edition, 2023. Accessed: 2024-05-20.

[73] Kexiong Curtis Zeng, Shinan Liu, Yuanchao Shu, Dong Wang, Haoyu Li, Yanzhi Dou, Gang Wang, and Yaling Yang. All your {GPS} are belong to us: Towards stealthy manipulation of road navigation systems. In 27th USENIX security symposium (USENIX security 18), pages 1527–1544, 2018.

[62] SoapySDR Contributors. SoapySDR - 0.8.1 - Device.h. https://github.com/pothosware/SoapySDR. Line 272. [63] Enrique Soriano-Salvador and Gorka GuardiolaMúzquiz. Sealfs: Storage-based tamper-evident logging. Computers & Security, 108:102325, September 2021.

[74] Robert Zuccherato, Patrick Cain, Dr. Carlisle Adams, and Denis Pinkas. Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP). RFC 3161, August 2001.

[64] Martin Strohmeier, Matthias Schäfer, Rui Pinheiro, Vincent Lenders, and Ivan Martinovic. On perception and reality in wireless air traffic communication security. IEEE transactions on intelligent transportation systems, 18(6):1338–1357, 2016. [65] Telcordia Technologies. Gr-1244-core: Clocks for the synchronized network: Common generic criteria. Generic Requirements (GR) Issue 4, Ericsson (formerly Telcordia), October 2009. [66] Nils Ole Tippenhauer, Christina Pöpper, Kasper Bonne Rasmussen, and Srdjan Capkun. On the requirements for successful gps spoofing attacks. In Proceedings of the 18th ACM conference on Computer and communications security, pages 75–86, 2011. [67] Tyler Tucker, Nathaniel Bennett, Martin Kotuliak, Simon Erni, Srdjan Capkun, Kevin Butler, and Patrick Traynor. Detecting imsi-catchers by characterizing identity exposing messages in cellular traffic. In Proceedings of the ISOC Networking and Distributed Systems Security (NDSS) Symposium. San Diego, CA, USA, 2025. [68] John Wiseman. GPSJAM: GPS interference maps. https://gpsjam.org/, 2022. Accessed: 2026-01-26. [69] Attila A. Yavuz, Peng Ning, and Michael K. Reiter. Efficient, compromise resilient and append-only cryptographic schemes for secure audit logging. In Financial Cryptography and Data Security, volume 7397 of Lecture Notes in Computer Science, pages 148–163. Springer, 2012. [70] Vivian Yee and Isabel Kershner. Tanker collision near Strait of Hormuz amid Israel-Iran tensions. The New York Times, June 2025. Accessed: 2026-02-05. [71] Paweł Zalewski. Real-time gnss spoofing detection in maritime code receivers. Scientific Journals of the Maritime University of Szczecin, 38:118–124, 2014. 18

Related documents

• Movable Antenna-Enabled Multi-Static Cooperative Secure ISAC: Architecture, Mechanisms, and Enabling Technologies#1388981
• Autonomous Shipping and Cybersecurity#1178782
• Reflections on security options for the real-time transport protocol framework#202712
• Reflections on security options for the real-time transport protocol framework#202184
• Cybersecurity in the Marine Transportation System#512242