A container ship's GPS told its crew they were hundreds of miles from where they actually were. They believed it. The ship ran aground in the Red Sea last year, millions of dollars in damage, five weeks of salvage. This isn't new. The first documented case of this exact attack goes back to 2017. What's changed is the scale, a research vessel monitoring the Baltic near Kaliningrad through last summer found GNSS positioning unavailable close to a fifth of the time it was at sea, and the Black Sea has reached near daily spoofing by some counts. It doesn't stop at the breakwater either. Container terminals run cranes and automated vehicles on GNSS fused with inertial sensors... It was never built to catch a signal that's present, confident, and lying.
Signal register
Signals from X
Public posts, experimentally classified on three axes: public impact, the systems that fail, and the industries in the blast radius. Estimates only — not a formal assessment.
Methodology — experimental estimates
Scores are automated, experimental estimates from public X posts and a hand-written seed corpus. They are not formal risk assessments, not certified, and not suitable for compliance or operational decisions.
Consequence, likelihood, and urgency are 1–5 judgements applied by this project, not by a standards body. Residual scores assume only the mitigations marked in place. A signed-in reviewer can override residual and mark an item reviewed — that override is still unofficial. Aspect tags (capability, domain knowledge, affordance, impact domain) are a lightweight PRA aid, not a formal hazard analysis.