Andøya: For two hours on 16 September, five Galileo satellites broadcast encrypted components alongside their ordinary signals while, on the ground at a Norwegian test range, equipment deliberately transmitted counterfeit navigation data at the receivers below. Conventional receivers did what counterfeit signals are designed to make them do and reported positions that were confidently, precisely wrong. One receiver did not. It held a position it could verify, and in doing so produced what the European Space Agency described as the first civil authenticated position fix obtained under spoofing conditions.
The distinction being demonstrated is narrow and matters enormously. Europe has had navigation-message authentication in operational service since July 2025, when the agency responsible for the space programme declared the initial Open Service Navigation Message Authentication capability available to users. That service lets a compatible receiver check that the data a satellite broadcasts genuinely came from Galileo. It does not check the other half of the calculation. A position is derived from data plus measurements of how long signals took to arrive, and an attacker who cannot forge the data can still manipulate the timing.
The Signal Authentication Service closes that second gap. The method is unglamorous and rather elegant: the receiver records a brief sample of an encrypted transmission it cannot yet interpret, waits for the key material to become available, and then confirms that what it captured matches what it should have captured. Authenticated ranging and authenticated messaging then work together, and the position that emerges can be defended rather than merely asserted.
What the Arctic test does not establish is equally important, and the agencies involved have been notably careful about saying so. A demonstration under tested conditions is not an operational service. An initial declaration is pencilled in for 2027, with validation and accreditation work still to run before that date. No installed receiver acquires the capability by having been near the news. Procurement documents that say a device uses Galileo tell a buyer almost nothing about whether it can authenticate anything at all, and the gap between those two statements is where a great deal of money is about to be spent badly.
The operational question underneath is harder than the cryptography. Authentication produces a third state that most systems were never designed to display. A screen can show a position, or it can show no position. It now has to be able to show a position that exists but has not been verified, and the humans reading that screen have to know what they are expected to do about it. A maritime bridge team, an air traffic controller and a logistics platform will each need a different answer, and none of those answers arrives with the satellite signal.
Nor does verification guarantee availability. Spoofing feeds a receiver false information; jamming denies it usable information altogether. Detecting that measurements cannot be trusted is genuinely useful, but a receiver that correctly identifies an attack and then has nothing to fall back on has still lost its position. Contingency planning for degraded navigation remains a separate discipline, unaffected by anything proved this month.
Adoption will follow the pattern message authentication set. Manufacturers have been folding the earlier service into professional receivers, particularly those used for timing and synchronisation where a false clock is a systemic hazard rather than an inconvenience. A pilot on two Romanian border police vessels tested authenticated tracking in an operational setting rather than a laboratory, which is where integration problems actually surface.
For a Union that has spent this year arguing about strategic autonomy in orbit while its ports, grids and financial clearing systems quietly depend on signals arriving from twenty-three thousand kilometres up, a verifiable position fix is not a technical footnote. It is the difference between infrastructure that can be told a lie and infrastructure that can notice.
