How robust is the international atomic time standard against malicious actors?

Question

This answer explains the international atomic time standard (TAI). The fact that the Russian GLONASS and American GPS systems are referenced to their national clock systems, which are then ultimately referenced to the average from the TAI, made me wonder whether a malicious state could damage the accuracy of another's GNSS system by intentionally misreporting their frequencies (while using the unskewed frequencies for their own GNSS), eg consistently under-reporting by a small enough amount that it's still within the error bars for each measurement but over time causes issues.

My suspicion is that the stability of TAI is so much better than what is needed for even high-precision military GNSS that this attack wouldn't be effective, but I couldn't verify that for myself.

An ideal answer would be something like "if every NATO member (or just half the members to get an easy number) contributing to TAI secretly agreed to this for a decade it could skew GLONASS measurements by [some distance]"

Answer 1

First, it couldn't happen. These offsets aren't done blindly like a bitcoin blockchain and "too bad" if you don't agree. TAI members review the inputs and the most stable clocks contribute the most to the average. That means any attempt to control it would show up as a simultaneous problem with multiple clocks that have shown consistent stability. That would warrant investigation. The algorithms that generate consensus have been updated and reviewed for their performance often in the past decade, so it can't simply be ignored or missed.

Second, the GNSS systems don't rely on any actual value of TAI to function. They deliver a time value to the end user that is derived from TAI, but the functioning of the navigation system would continue regardless of the absolute value. As the operation of the system depends on the control segment determining where the satellites are with respect to known ground transmitters, as long as both the ground and the space segments are using the same time, there is no effect on spatial navigation. Vehicle ephemeris is recalculated and uploaded daily, so shifts of this value over a decade is irrelevant.

Both astronomers and GNSS providers have to contend with the fact that the earth's rotation is not as stable as TAI. The earth's rotation slows down and speeds up by detectable amounts over months. As these variations are handled, any variation in TAI would have to be (much) larger to be outside the range of easily corrected.

Answer 2

An attack on TAI would not impact the positional accuracy of any of the GNSS systems. Each GNSS systems uses its own realization of UTC(k) for its satellites. Even if this realization drifts away, it will not matter as all satellites still get a consistent timescale.

As for malicious actors and their potential effect on different realizations of UTC(k), the answer is quite a bit more complicated. The people managing the systems all over the world are a relatively small group that know each other quite well. There is a lot of trust in peers of this group and that shows in the whole setup of the system. While there are cross checks, these are meant more for unintentional errors in the system due to mistakes and equipment failure rather than for malicious participants. There are quite a few points where a malicious actor could inject errors in the path between atomic clock to the measurement being reported to the BIPM. While the BIPM does not blindly use any of the numbers and does a lot of checks (there is a reason why the publications of Circular-T takes so much time), a dedicated attacker could circumvent those.

That said, to get any significant difference between two UTC(k), one would need to slowly and consistently change the data, otherwise it would show up in one of the checks. So slowly that it would take years to get more than a few 100s of ns of time difference. And you would need to be able to manipulate all checks done on the system, which is close to impossible. E.g. the main way of time transfer is by using two way satellite time and frequency transfer (TWSTFT), i.e., measuring the difference between two realizations of UTC(k) with a dedicated satellite. The different regions of the world are split into separate groups, with each group having a coordinator and measure the differences in a round-robin fashion. The coordinator is responsible to transmitting the measurements to the BIPM. Additional to TWSTFT it is quite common to employ GNSS common view (think of measuring the relative offset to each visible satellite separately) to fill the gaps between TWSTFT sessions and decrease the measurement noise. While GNSS common view has more biases that cannot be compensated, it still offers precision in the same order of magnitude as TWSTFT, and thus, if calibrated regularly, also the same accuracy. Both GNSS common view and TWSTFT usually agree up to a few ns and the drift is usually slow. On top of that, for a sanity check, GNSS all in view (think of it the "normal" use of GNSS to get time) is used, even though it usually offers only an accuracy of <10ns. But that's already accurate enough to show most drifts that went unnoticed by the other systems.

To get any technically significant offset, you'd need to shift one target UTC(k) by more than 1µs to get any form of attack that would work on a system (at least on any I am aware of). And such a large offset would show up in the checks mentioned above.