28 Sept, 2026
Building GPS Satellites Is Not Enough. Sovereignty Ends in Silicon.
In January 2023, GPS-guided Excalibur shells fired by Ukrainian forces hit what they were aimed at 55% of the time. By August, it was down to a mere 6%. As a result, the cost per successful strike went from about $300,000 to $1.9 million, forcing the US to eventually stop shipping them to Ukraine due to the high miss-rate.
To be very clear, none of that involved attacking a satellite. The main reason behind the high miss-rate was the GPS signal itself. By the time a GPS signal from a satellite reaches the earth it is weaker than the background radio noise around it, which is why a jammer mounted on the back of a truck can bury it across an entire front line for a tiny fraction of what the shells cost.
This kind of attack aka jamming, is the only cruder half of the problem. In September 2023, an aircraft flying along the Iraq–Iran border began receiving GPS that was not absent but actually false, shifting their apparent position by around 60 nautical miles. Because modern avionics continuously update the inertial reference system from GPS, the fake positions were written into the backup as well, so the fallback the crews were meant to reach for had already been corrupted by the time they reached for it. Sixteen aircraft reported it within days, one came close to entering Iranian airspace without clearance, and several crews ended up asking air traffic control the two questions no airliner should ever have to ask, which were what time is it, and where are we. That distinction matters for everything that follows. A jammed receiver knows that it has lost the signal and can say so, which makes jamming a problem of physics and antennas. A spoofed receiver knows nothing is wrong, reports a confident and precise position that happens to be a lie, and quietly poisons whatever was supposed to check it. Catching that is not a matter of building a better radio; it is a matter of whether the signal can prove where it came from, and whether the receiver checking that proof can itself be trusted.
Meanwhile, and for somewhat related reasons, the world has spent thirty years building alternatives to GPS. There are now six navigation systems in the sky and a seventh being built: GPS (United States), GLONASS (Russia), Galileo (Europe) and BeiDou (China) globally; NavIC (India) and QZSS (Japan) regionally; and South Korea spending 3.7 trillion won (approximately USD 2.8 billion) on an eight-satellite constellation of its own, with a first launch targeted for 2027. None of those programmes however was a response to jamming, since Galileo was conceived in 1999, BeiDou in the 1990s and GLONASS is older than both. Nor would they have helped, because a sovereign signal jams exactly as easily as a foreign one.
To reiterate, two separate things are going on here, and they get conflated constantly. The first is a question of control, meaning who is able to switch your navigation off, and that is the half genuinely solved by owning satellites. The second is a question of trust, meaning whether your receiver can tell a real satellite from a convincing liar, and that half will have to be solved in silicon.
Why everyone else built their own
Take the control question first, because it is the older of the two and it is the one that explains why all of those constellations exist in the first place. Until May 2000, GPS carried Selective Availability, or SA, a deliberate degradation of the civil signal that held ordinary receivers to an accuracy of roughly 100 metres. President Clinton switched SA off at midnight on 1 May 2000, and the statement announcing it is the part worth reading: "We have demonstrated the capability to selectively deny GPS signals on a regional basis when our national security is threatened."
That posture became formal doctrine in 2004 when a directive instructed the Secretary of Defense to "deny to adversaries position, navigation, and timing services from the Global Positioning System… and/or any other space-based position, navigation, and timing systems."
None of this requires bad faith on anyone's part. It is what it looks like when critical infrastructure for the entire planet is operated by one country's air force. Every other capital did the arithmetic and reached the same conclusion. India's founding story for NavIC apparently is that the US denied GPS to Indian forces during the Indo-Pakistan war in 1999.
The threat has since stopped asking permission at all. The international airline body and Europe's aviation safety regulator reported that GPS signal-loss events rose 220% between 2021 and 2024, Lithuania logged 46 pilot-reported jamming incidents in June 2024 against 1,022 in June 2025, and spoofing grew from roughly 200 flights a day in early 2024 to a peak of 1,350 in a single day. In October 2025 the United Nations civil aviation assembly formally condemned interference originating from Russia and North Korea.
Spoofing is the sharper problem, because a jammed receiver knows it is lost and a spoofed one does not. Spoofing of the kind that caught those aircraft over Iraq has scaled just as quickly. Researchers at the Zurich University of Applied Sciences tracked roughly 200 flights a day being spoofed in the first quarter of 2024, around 900 a day by the second quarter, and a peak of 1,350 flights in a single day, with the affected regions growing from three to more than ten and now taking in northern Iraq, Cairo, Israel, the Black Sea, Cyprus and the Korean border.
This is the half of the problem that no amount of satellite launching fixes, and it is where the interesting engineering sits. Owning your own constellation will not fix this. A sovereign signal is just as jammable as a foreign one. Which brings us to the part that actually matters.
Three grades of navigation signal
Almost everything most people call "GPS" is the weakest of three tiers.
Type 1, open and unsigned. Every constellation broadcasts a free civil signal, and this is the one your phone uses. So does your car, your drone, and the timing card that keeps a telecom tower or a trading floor in sync. The format is published, and nothing inside the signal proves who sent it. The receiver simply trusts whatever arrives in the right shape. A software-defined radio costing a few hundred dollars can produce a convincing imitation.
Type 2, open but signed. The signal is still readable by anyone, but the operator now signs the message it carries. A receiver can check that signature and tell whether the message really came from the satellite it claims. Nothing is hidden, and nothing needs to be. The point is not secrecy; it is that forgery and spoofing stops being easy.
Type 3, encrypted. Here the signal itself is encrypted, and only a receiver holding the right keys can use it at all. Every constellation keeps one of these for its own government: America has M-code, Europe the Public Regulated Service, China its authorised signals, India the Restricted Service. This grade gives both proof of origin and control over who may use the signal, which is why it is not offered to the rest of us.
The assumption worth correcting is that the Type 2 is also defence-only. It no longer is, and that is the most important change in this field in a decade. Europe began signing its ordinary open signal on 24 July 2025, under a scheme called Open Service Navigation Message Authentication, free, global and available to any receiver manufacturer who implements it. India has proposed something similar for NavIC, built on the same method, and the US has its own design called Chimera.
Where HoloDi fits
This is where we have an interest to declare: it is the problem we built our chip for.
HoloDi S1 is a secure element: a small chip that generates and holds keys on the die itself, performs its cryptography in hardware including the new post-quantum standards, keeps a counter that can only ever move forwards, and carries an active tamper mesh that erases its secrets if anyone opens it up.
In a navigation receiver it is where the keys live, and both kinds of keys belong there: keys for Type 2 and Type 3 receivers. For the signed Type 3 grade, the receiver needs the operator's verification key. That one is public, so there is nothing to keep secret about it, but it has to sit somewhere the host software cannot quietly delete it or swap it. Alongside it sits the forward-only clock, which is what stops yesterday's published signing keys being replayed as though they were today's.
For the encrypted Type 3 grade, the receiver needs the decryption keys that make the protected signal usable at all. Those are secrets in the ordinary sense. They are generated on the chip, never leave it, are used only inside it, and are erased if the device is opened, so that a downed airframe or a stolen roadside cabinet yields nothing anyone can clone.
What separates this from any other secure element is that you can check it yourself, at three levels.
The design is published. The full logic description of the chip is open with no confidentiality agreement, so an evaluator reads the actual design rather than a datasheet describing it.
The fabricated chip can be inspected. Infra-red imaging through the back of the package, without destroying it, produces a picture that can be compared against an overlay derived from that published design. It resolves to a little over a micron, which at this process size means it verifies functional blocks, memory sizes and routing density. That is enough to catch a substituted die, a missing or added block, or extra logic large enough to disturb the layout. Because the inspection is non-destructive, it examines the very part you go on to deploy, rather than a sacrificial sample from the same batch.
The firmware can be rebuilt. The start-up software is open and reproducible byte for byte, so an evaluator compiles it from source and checks the result against what is actually running on the chip.
Path to sovereign manufacturing. HoloDi's wafers are currently fabricated at TSMC on a 22-nanometre process. However, given that the design of the chip is public, the production can be ported to a domestic foundry. The design is held under no foreign licence and can be modified as needed.
Why this matters for a sovereign navigation system
Every sovereign navigation programme in the world ends at the antenna. A country can launch its own satellites, run its own control centre and broadcast its own encrypted service, and all of that is real sovereignty. But the moment the signal reaches the ground, the decision about whether to believe it is taken by a receiver, and inside that receiver by a security module holding the keys. If the module is bought from abroad under terms that forbid you from building one or looking inside it, then the sovereignty stops at the edge of the atmosphere.
That is not a hypothetical constraint. It is the published condition of access to America's Type 3 service, and it is why the encrypted tier is the hardest part of a navigation system to indigenise. Satellites can be built. Ground segments can be built. The security module has been, until now, the component a nation either imported on someone else's terms or did without, and a country that does without has no protected navigation service at all, whatever is flying overhead.
HoloDi holds the operator's verification key and checks the signature on each navigation message. It holds the decryption keys for a restricted signal, where nobody can extract them. It keeps the forward-only clock that defeats replay. And it signs the position and time the receiver finally produces, so that everything downstream, e.g., a flight controller, a weapon, a timing card in a substation can tell whether the fix it has just been handed is genuine.
This is the gap HoloDi is built to close, and it is why verifiability matters here as much as sovereignty does. A root of trust you cannot inspect is not a remedy for a foreign dependency; it is the same dependency wearing a different flag. HoloDi can be read at the level of its design, imaged at the level of its silicon and rebuilt at the level of its firmware, by the agency doing the certifying, without anyone's permission being required. That is the difference between a component a state can stand behind and one it can merely purchase.
India is in the middle of exactly this question. NavIC has a Type 2 service, and it will need receivers, and those receivers will need somewhere trustworthy to hold their keys. And that could be HoloDi.
