What is the risk of infrequent events and outdated GPS systems?

[anorlunda]

From today's news:
https://arstechnica.com/information...vent-on-april-6-could-have-some-side-effects/

Most newer GPS receivers will shrug off the rollover because they’ve been programmed to accommodate the epoch change. But older systems won’t—and this may prove to have some interesting side-effects, as timing data suddenly jumps by 19.7 years. The clock change won’t directly affect location calculations. But if GPS receivers don’t properly account for the rollover, the time tags in the location data could corrupt navigation data in other ways.

But navigation isn't the only concern. There are many systems that use the time for other purposes—cellular networks, electrical utilities, and other industrial systems use GPS receivers for timing and control functions. Since many of these systems have extremely long lifecycles, they’re the ones most likely to have not been updated.

The rollover issue isn’t limited to one day. Because of the way some manufacturers accounted for the rollover date in the past—by hard-coding a date correction into receivers’ firmware—their systems might fail at some arbitrary future date. Some have already succumbed: in July of 2017, an older NovAtel GPS system failed, and while the company issued a notice months earlier warning users to upgrade firmware, many remained ignorant of the notice until it happened. Motorola OncoreUT+ systems and some receivers using Trimble’s GPS engines also have failed over the past three years for similar reasons.

There is an entire class of risks that I could label "infrequent events". The mother of all of them was Y2K. (Y2K bad consequences were avoided via massive publicity, money, and remedial efforts.) What they have in common is that the very long time between events, causes manufacturers, consumers, everyone to slack in vigilance. The irony is that the longer the time between events, the greater the risk. More dependable = more risky. That sounds contradictory.

I wrote before on PF that in some cases we should intervene to increase the resilience of industry and consumers. https://www.physicsforums.com/threads/staged-blackouts.922146/ One of the comments on that thread is that the same thinking should apply to GPS.

IOT (the Internet of Things) makes the problem worse. We own, or will own, smart devices which we never expect to update to the latest software revision. Light bulbs, smart wall plugs, applicances, automobiles ... Indeed, we might buy them in a store but the manufacturers were nameless faceless people who market wholesale goods on alibaba.com. There is almost no hope of contacting those manufacturers in the future.

The article says that the remedy for GPS is to increase the internal week counter from 10 bits to 13 bits. I argue that will make the problem worse! They should shorten it, so that the date rollover events happen frequently enough that we are all confident that no large scale negative onsequences will occur. Longer intervals allow more nameless, faceless, manufacturers to come an go and to be forgotten before the consequences of their lack of vigilance become evident.

 

[FactChecker]

That is an interesting take on risk.
One thing to consider is that a failure which is sufficiently delayed is more likely to be in a system that will become obsolete and replaced before the failure occurs.
Another thing to consider is that software backups can bring back bugs later that will fail. My job during Y2K was to change all the modify dates on backup tapes so that they could be retrieved correctly if needed. My programs that converted all the backup tapes to usable tapes kept me swapping tapes around the clock for weeks.

 

[anorlunda]

Another factor I failed to mention in the OP is the public perception of risk as opposed to the objective measure of risk. More frequent events serve to bolster public confidence that we can deal with it.

If people are suddenly made aware of a risk previously unknown to them, they are vulnerable to panic and demagoguery. An example is Ted Koppel's book Lights Out: A Cyberattack, A Nation Unprepared, Surviving the Aftermath. Koppel used his famous name to make it a best seller. The book basically says that we are screwed. Hackers will utterly destroy the power grid and bring down civilization; build your underground bunker and stock up on machine gun ammo for the post-apocalypse world. The public can't judge the technical merits of such a topic, but because they never experienced a national blackout, they are prepared to fear the worst.

 

[jedishrfu]

@anorlunda has it right we need shorter failovers or perfect systems. Since we can’t expect perfect then we should expect maintenance cycles such as this.

With respect to the national grid, NOVA showed how a power generator and it’s personal controller could be hacked allowing unnamed actors to mess with the frequencies of operation placing the device into an unstable resonant frequency that destroys the generator.

 

[anorlunda]

With respect to the national grid, NOVA showed how a power generator and it’s personal controller could be hacked allowing unnamed actors to mess with the frequencies of operation placing the device into an unstable resonant frequency that destroys the generator.

I am familiar with that demo. Do you see what a huge stretch that is to extrapolate it to regional or national blackouts?

The power grid is designed to survive multiple simultaneous failures. It gets demonstrated with every major weather event. The 1998 ice storm in Canada and the US knocked down about 300000 poles, and isolated dozens of generators. Yet the blackout did not extend beyond the ice storm boundaries.

 

[jedishrfu]

This is true but a computer attack from a state actor could be markedly different if you consider the morris worm or the ibm online xmas card fiasco. We are protected from that mayhem but there are other zero day exploits to come.

 

[anorlunda]

I elaborated on the power grid cyber security issues in this Insights.
https://www.physicsforums.com/insights/ac-power-analysis-part-3-cyber-resilience/

 

[WWGD]

But being in constant high alert creates sort of awareness fatigue which creates its own issues.

 

[WWGD]

This is true but a computer attack from a state actor could be markedly different if you consider the morris worm or the ibm online xmas card fiasco. We are protected from that mayhem but there are other zero day exploits to come.

Stuxnet...

 

[jedishrfu]

Beyond stuxnet that was so yesterday... :-)