Short answer: for a pilot, the most frequent cybersecurity risk in aviation today is interference with the GNSS signal. IATA recorded 57 GPS signal losses per 1,000 flights in 2025, twice the 2021 rate. Since 22 February 2026, EASA Part-IS has required operators to manage information security, including staff competence.
What are GNSS jamming and spoofing?
Jamming blocks the signal: the receiver loses its position. Spoofing tricks the receiver with a false signal: the aircraft shows the wrong position or time, with no obvious warning.
Spoofing is the more dangerous of the two. It can affect terrain warning, the clock and navigation, and the receiver can take more than 30 minutes to recover afterwards, according to a working paper by IFALPA and other organisations at the 2025 ICAO Assembly.
How often does it happen?
GPS signal losses per 1,000 flights (IATA flight data):
| Year | Losses per 1,000 flights |
|---|---|
| 2021 | 28.1 |
| 2022 | 30.9 |
| 2023 | 39.9 |
| 2024 | 56.1 |
| 2025 (provisional) | 57.1 |
Source: IATA, GNSS Interference Safety Risk Assessment V6, February 2026.
Since 2024, the rate has been above twice the 2021 level.
In the Baltic, the share of flights affected rose from about 7.5% in May 2024 to 27.4% in April 2025, and passed 42% in some flight information regions. The data was presented to ICAO by six States in the region.
In October 2025, the ICAO Assembly condemned Russia and North Korea for GNSS interference, calling it an infraction of the Chicago Convention.
What does EASA recommend to pilots?
EASA’s safety information bulletin on GNSS (SIB 2022-02, revision R3, July 2024) recommends:
- Including jamming and spoofing in recurrent training.
- Reporting promptly to air traffic control.
- Assessing the effect of GNSS loss on terrain warning.
- Not dispatching into affected areas with back-up systems inoperative.
- Planning procedures that do not depend on GNSS and confirming position by other means.
- For spoofing, monitoring estimated position uncertainty and comparing GNSS time with other sources.
Revision R4, from July 2026, added standard pilot–controller phraseology and now covers EFBs. In March 2026, EASA and EUROCONTROL published a joint action plan with updated guidance for crews and controllers.
What is Part-IS and who does it apply to?
Part-IS is EASA’s set of rules on information security in aviation. It has two phases, according to EASA:
| Regulation | Applies from | To whom |
|---|---|---|
| Delegated Regulation (EU) 2022/1645 | 16 October 2025 | Design and production organisations, aerodrome operators, apron management services |
| Implementing Regulation (EU) 2023/203 | 22 February 2026 | Air operators, training organisations, maintenance, air navigation services, authorities |
Organisations in scope must have an information security management system, assess risks, report significant incidents to the authority within 72 hours and ensure staff have the necessary competence.
Why does this matter to pilots, not just IT?
Because many risks reach the flight deck. ADS-B transmits without encryption, which makes it vulnerable, according to a working paper presented to the 2025 ICAO Assembly. EFBs are networked tablets. And in September 2025, Collins Aerospace showed that a ransomware attack on one supplier can stop check-in at several airports at once.
In ENISA’s 2025 threat landscape report, transport was the second most targeted sector in the EU, with 7.5% of incidents. Within transport, 58.4% of incidents were in air transport.
In Resolution A42-19, ICAO calls for ‘continuous training of qualified and competent aviation and cybersecurity professionals’. In April 2026, IFALPA called on operators for risk assessments, training and clear procedures for corrupted-GNSS scenarios.
What is the role of reporting?
The programme was created with APPLA (Portuguese Airline Pilots Association) and follows Part-IS. It is not an IT course: it looks at the risks from the point of view of those who fly.
- GNSS spoofing and jamming: recognise, confirm, report
- ADS-B, ACARS and EFBs: where the vulnerabilities are
- Reporting culture and what Part-IS requires of operators
- For licensed commercial pilots and FOOs, including current and aspiring Postholders, Safety Managers and Compliance Monitoring Managers
Format: 40 hours online, with live classes led by an instructor, after working hours: three evenings a week, 18:30–21:30, compatible with flying rosters. Classes of 12 pilots. Participants receive a certificate on completion.
Frequently asked questions
What is the difference between jamming and spoofing?
Jamming blocks the GNSS signal. Spoofing replaces it with a false signal that shows the wrong position or time.
Does Part-IS apply to airlines?
Yes. Since 22 February 2026 it has applied to air operators certified in the EU, among other organisations.
Do I need coding skills for this programme?
No. The programme is operational, designed for pilots and FOOs, not IT technicians.
Where in Europe is GNSS interference most common?
In the Baltic and Eastern Europe. The six States that reported to ICAO located the emitters in Kaliningrad, Pskov, St Petersburg and Smolensk.
Sources
- IATA, GNSS Interference Safety Risk Assessment V6, February 2026; press release on GNSS, 18 June 2025
- ICAO, A42-WP/553, A42-WP/108, A42-WP/479, 2025
- ICAO, Assembly condemns GNSS interference, 3 October 2025; Resolution A42-19
- EASA, SIB 2022-02R3, 5 July 2024; revision R4, 3 July 2026
- EASA, Easy Access Rules for Information Security, December 2025; FAQ Applicability; AMC & GM to Part-IS.I.OR, 12 July 2023
- EUROCONTROL, EASA–EUROCONTROL action plan, 26 March 2026
- ENISA, Threat Landscape 2025, October 2025
- IFALPA, statement on GNSS interference, 26 April 2026
- TechCrunch, ENISA confirms ransomware, 22 September 2025
