Wireless Jamming and Physical Layer Security Guide

Every wireless link, from Wi-Fi and private 5G to GNSS timing, key fobs and industrial telemetry, can be attacked below the cryptography: a jammer denies the channel, a relay stretches distance, a stronger signal overshadows the real one, and emanations leak data that encryption never touched. These attacks matter more each year as alarms, door access, vehicle keys, warehouse robots and safety systems move to radio. This guide summarises the physical layer threats described in the CyBOK Physical Layer and Telecommunications Security knowledge area and turns them into practical defences: designing for jamming, detecting interference, resisting relay and spoofing, controlling emanations, and responding within the law. It is written for network, OT and physical security engineers and for architects choosing wireless technologies for critical functions.

Key takeaways

Cryptography does not give availability. WPA3, TLS and 5G encryption protect content and integrity, but a jammer that drowns the channel still takes the link down, so critical functions need a non-radio fallback.
Spread spectrum only resists jamming when the spreading code is secret. CyBOK notes that public codes, as in GPS and 802.11b, remain vulnerable to an attacker who knows them.
Distance can be faked. Relay attacks make a key fob, card or phone appear close when it is not; only time-of-flight distance bounding, such as properly designed UWB ranging, resists them.
Detection is mostly anomaly spotting. Rising noise floors, synchronised loss across many devices, implausible signal strength or position jumps are the signals to monitor.
Responding is constrained by law. In the US, the FCC states that jammers are prohibited for businesses and individuals, with only limited exceptions for certain federal agencies, so the response is to locate, report and fall back, never to jam back.

The physical layer threat model

CyBOK's knowledge area (version 1.0.1, edited by Srdjan Čapkun, George Danezis and Awais Rashid) groups physical layer attacks into a small number of families. The table maps each to what it threatens and the main defence.

Attack family	How it works (conceptually)	Property lost	Primary defences
Jamming	Constant, reactive or surgical transmissions that prevent reception; reactive jammers sense traffic first, which saves energy and avoids detection	Availability	Spread spectrum with secret codes, frequency diversity, wired fallback, detection and location
Overshadowing and signal annihilation	A stronger signal that the receiver locks onto, or an inverted signal that cancels the real one	Integrity of signal-derived data (timing, position, presence)	Cryptographic authentication, signal anomaly checks, multi-receiver consistency
Relay (wormhole) and distance fraud	Forwarding signals so that a distant device seems near	Proximity-based access control	Distance bounding with short, unpredictable symbols; UWB time-of-flight; motion or context checks
Spoofing of unauthenticated signals	Transmitting forged GNSS, ADS-B or sensor signals	Integrity of position, time and sensor readings	Navigation message authentication, anomaly detection, multi-receiver checks
Radio fingerprint forgery	Replaying signals or features to impersonate a device's analogue traits	Device identification	Use fingerprinting only as an extra signal, with data-dependent features
Compromising emanations and sensor injection	Unintended radio, acoustic or optical emissions leak data; injected interference manipulates sensors	Confidentiality; sensor integrity	Shielding, filtering, separation, zoning, sensor self-checks

ATT&CK covers the impact side: T1464 Network Denial of Service for mobile devices, T1498 Network Denial of Service in enterprise networks, and in ICS T0814 Denial of Service, T0815 Denial of View, T0832 Manipulation of View and T0830 Adversary-in-the-Middle. NIST SP 800-53 has a dedicated control, SC-40 Wireless Link Protection, with enhancements for electromagnetic interference (SC-40(1)), imitative or manipulative communications deception (SC-40(3)) and signal parameter identification (SC-40(4)).

Jamming: designing links that degrade gracefully

Most commercial wireless technologies are designed for coexistence and efficiency, not adversarial resilience. Treat jamming resistance as a design property you choose, not one you get by default.

Technique choices

Coordinated spread spectrum: frequency hopping (FHSS), direct sequence (DSSS) and chirp spreading make narrowband jamming less effective, but CyBOK stresses that this only holds when the spreading sequence or hopping pattern is secret. Military and some industrial radios key their hopping patterns; consumer technologies generally do not.
Uncoordinated techniques: research schemes such as uncoordinated frequency hopping (UFH) and uncoordinated DSSS support jamming-resilient broadcast without a pre-shared key, at the cost of throughput. They matter for bootstrapping keys in contested environments.
Diversity: multiple bands (2.4 GHz, 5 GHz, 6 GHz, sub-GHz), multiple technologies (Wi-Fi plus cellular plus wired) and multiple sites reduce the chance that one jammer removes every path.
Fail-safe behaviour: define what each system does when the link is lost: an alarm panel that reports "communication lost" as an alarm, a robot that stops safely, a door that fails to the safe state for its risk.

Technology by technology

Technology	Jamming and spoofing exposure	What to do
Enterprise Wi-Fi	Unlicensed bands are easy to jam; management frame forgery can disconnect clients on networks without Protected Management Frames	WPA3 with PMF (the Wi-Fi Alliance requires PMF for WPA3 networks and all new certified devices); wired connections for critical endpoints; WIPS monitoring
Private LTE or 5G	Licensed or shared spectrum, but still jammable; base station impersonation risks on older generations	Spectrum monitoring, SA core with modern authentication, fallback to wired backhaul
GNSS for position and timing	Civilian signals are unauthenticated with public spreading codes, so they are easy to jam and spoof	Multi-constellation receivers, holdover clocks, terrestrial time sources, anomaly detection
Wireless alarms and access control	Sub-GHz links can be jammed to suppress alarms; proximity cards and fobs can be relayed	Supervised links that alarm on loss, dual-path signalling, distance bounding
Industrial wireless (WirelessHART, ISA100, proprietary)	Loss of telemetry or control, manipulated readings	Mesh redundancy, safety functions that do not depend on the radio link, OT monitoring
Bluetooth, NFC and RFID	Relay attacks against proximity unlock and payments	Distance bounding, user presence, timing limits

Small organisations rarely need spectrum monitoring: the priorities are WPA3 with PMF, wired connections for alarms and cameras where possible, alarm panels that report loss of communication, and a time source with holdover if any system depends on GNSS time. Large organisations, utilities and transport operators should add permanent spectrum and GNSS monitoring at critical sites, jamming-resilient radios for safety-critical telemetry, and procurement requirements that ask suppliers how each product behaves under interference.

For deeper coverage of individual technologies see the Wi-Fi Security Guide, the GNSS Spoofing and Jamming Guide, the Bluetooth, RFID and NFC Security Guide and the HART, WirelessHART and ISA100 Security Guide.

Relay attacks and secure proximity

Many systems use "the device is near" as an authentication factor: car keys, building access, phone-as-key, contactless payments and passwordless sign-in. CyBOK describes four classes of distance attack (distance fraud, mafia fraud, terrorist fraud and distance hijacking) and explains why only some ranging methods resist them.

Ranging method	Resistance to relay and distance reduction	Notes
Received signal strength (RSSI)	Weak: trivially manipulated by amplification	Use only as a coarse hint
Phase-based ranging	Limited: vulnerable to phase rollover manipulation	Common in low-cost radios
Time-of-flight with UWB or chirp signals	Strong when properly designed with short symbols and unpredictable challenges	Early-detect and late-commit attacks exploit long or predictable symbols
Distance bounding protocols (Brands-Chaum, Hancke-Kuhn families)	Strong: cryptographic challenge-response bounded by speed of light	Requires fast, minimal processing at the prover

For buyers: ask whether a proximity product uses time-of-flight ranging with cryptographic distance bounding, or only signal strength.
For identity teams: proximity is a weak factor on its own. Combine it with user presence or verification on the device, as FIDO authenticators do, and with context such as motion or expected location.
Secure positioning: CyBOK describes verifiable multilateration, which uses at least three verifiers in two dimensions (four in three) so that spoofing a position inside the verifiers' area would require shortening a measured distance, which distance bounding prevents.

Emanations and sensor spoofing

Compromising emanations are unintended radio, acoustic, optical, thermal or electromagnetic emissions that leak information. CyBOK cites display emissions (the TEMPEST problem), voltage regulator sounds that leaked RSA keys, and keystroke sounds. The defensive controls are physical and procedural rather than cryptographic.

Zoning: process the most sensitive information in rooms or zones where an attacker cannot place receivers close enough, which is the logic behind NIST SP 800-53 PE-18 Location of System Components and PE-19 Information Leakage.
Shielding and filtering: shielded enclosures and rooms, filtered power and signal lines, and separation of sensitive cabling from cables that leave the zone.
Air gaps: air-gapped systems still emit; combine isolation with emission controls when the threat justifies it.
Sensor integrity: injected interference or sound can manipulate microphones, accelerometers and ultrasonic rangers. CyBOK suggests periodic self-checks (switching a sensor off and checking for unexpected output) and challenge-response for active sensors, which matter for autonomous, medical and safety systems.

Physical layer identity: useful signal, weak credential

Radio fingerprinting identifies a transmitter from analogue imperfections such as modulation errors and turn-on transients. It can help a wireless intrusion system notice that a "known" access point or sensor now looks different. CyBOK lists the attacks against it (signal replay, feature replay, hill-climbing forgery and jamming of transients) and notes that modulation-based fingerprints have been impersonated with reasonable success. Treat fingerprints as a detection signal, never as the credential: the identity of a sensor, gateway or base station should rest on keys and certificates provisioned and rotated like any other machine identity. See the IoT and Device Certificate Provisioning (EST, SCEP) Guide.

Implementation: a phased programme

Inventory radio dependencies: list every function that depends on a wireless link or radio signal, including timing (GNSS), alarms, door access, OT telemetry, vehicles and payments, and record what happens if the link is lost or manipulated.
Classify by consequence: safety, security, financial and convenience. Safety and security functions must have a defined fail-safe state and, where possible, a non-radio path.
Close the easy gaps: enable WPA3 with PMF, supervised alarm links, multi-constellation GNSS with holdover, and wired connections for fixed critical devices.
Add monitoring: deploy spectrum or wireless intrusion monitoring at critical sites and GNSS anomaly monitoring on timing receivers. Start in observe mode to learn the normal noise floor.
Test in controlled conditions: exercise loss-of-link behaviour by disconnecting or shielding devices, or with test equipment in a licensed or shielded test facility. Never test with jammers on live spectrum: in the US the FCC prohibits operating jammers outside limited federal exceptions.
Write the response playbook: who confirms interference, who locates the source, who reports it to the regulator, and how operations fall back.
Review procurement: add jamming behaviour, relay resistance and authentication of signals to requirements for new wireless systems.

Detection and response

Interference indicators: sudden rise in the noise floor, many clients losing connectivity at the same time, retransmission spikes, or GNSS receivers reporting loss of lock together.
Spoofing indicators: implausible signal strength, position or time jumps, disagreement between receivers or constellations, and abnormal automatic gain control behaviour, which CyBOK lists among GNSS anomaly detection features.
Correlate with physical events: a jammed alarm link alongside a door event or a vehicle in a car park is an incident, not a fault.
Report through the right channel: in the US, the FCC asks consumers to contact their provider first and then file a complaint selecting "Signal Jammers"; law enforcement uses the FCC Enforcement Bureau's PSIX-ESIX portal, and the FCC 24-hour Operations Center (202-418-1122) handles cases where safety of life is threatened. Other countries have their own spectrum regulators; record their contacts in the playbook.

Metric	Why it matters
Critical radio-dependent functions with a documented fail-safe and fallback path	Shows availability is designed, not assumed
Wi-Fi networks with WPA3 and PMF enforced	Removes management frame forgery as a cheap denial path
Timing receivers with holdover and anomaly alerts	Limits impact of GNSS jamming or spoofing
Critical sites with spectrum or WIPS monitoring	Enables detection and location of interference
Mean time to confirm and locate an interference source in exercises	Measures response readiness
Proximity-based access systems using time-of-flight ranging	Tracks relay resistance across the estate

Legal constraints

The FCC states that Section 301 of the Communications Act requires transmitters to be licensed or authorised, Section 302(b) bans the manufacture, importation, marketing, sale or operation of signal jammers, and Section 333 prohibits wilful or malicious interference with licensed or government radio communications. Only certain federal law enforcement agencies may use jammers under limited exceptions; the FCC says there are no exemptions for use in a business, classroom, residence or vehicle. Penalties include forfeitures, equipment seizure and criminal sanctions. Most other jurisdictions restrict jammers in a similar way, so counter-jamming, signal blocking for "phone-free" rooms and similar ideas need legal review before anyone buys equipment. This section summarises US rules as published by the FCC and is not legal advice; check the regulator in each country where you operate.

Common failure patterns

Silent failure: wireless alarms, cameras or sensors that simply stop reporting under jamming without raising an alarm.
GNSS as the only clock: networks, trading systems or substations that lose time when GNSS is jammed because no holdover or terrestrial source exists.
Proximity as authentication: door or vehicle access granted by signal strength alone, which relay devices defeat.
Legacy Wi-Fi without PMF: clients that can be disconnected by forged management frames, which makes targeted denial cheap.
Testing with jammers: well-meant tests on live spectrum that break the law and disrupt neighbours and emergency services.
Fingerprints as credentials: trusting a device because its radio "looks right" rather than because it holds a valid key.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	SC-40 Wireless Link Protection, SC-40(1), SC-40(3), SC-40(4)	Protection against interference, deception and signal parameter identification
NIST SP 800-53 Rev. 5	SC-5 Denial-of-service Protection; CP-8 Telecommunications Services	Resilience and alternate communications paths
NIST SP 800-53 Rev. 5	PE-18, PE-19; SI-4 System Monitoring	Emanation control and monitoring
NIST CSF 2.0	PR.IR-03, DE.CM-01	Resilience in adverse situations; network monitoring
MITRE ATT&CK v20	Mobile T1464; enterprise T1498, T1557; ICS T0814, T0815, T0832, T0830	Denial, loss and manipulation of view, interception
CyBOK	Physical Layer and Telecommunications Security knowledge area	Reference body of knowledge for the threat families

Practitioner checklist

Inventory every safety, security and timing function that depends on radio, with its fail-safe state.
Provide a wired or alternate path for critical functions, and alarm on loss of supervised wireless links.
Enforce WPA3 with Protected Management Frames on enterprise Wi-Fi.
Use multi-constellation GNSS with holdover and anomaly alerts for timing.
Require time-of-flight distance bounding for proximity access, or combine proximity with user verification.
Deploy spectrum or wireless intrusion monitoring at critical sites and baseline the noise floor.
Apply emanation zoning and shielding where the most sensitive processing takes place.
Write an interference response playbook with regulator contacts, and test only in shielded or licensed facilities.

Physical Layer and Wireless Jamming Guide: Detecting, Resisting and Responding to RF Attacks