An argument was made here about time before: that it is harder than it looks and duller than it sounds, and that distributed systems quietly assume a shared clock they have not earned. That entry treated drift and leap seconds as the adversaries. They are the benign case.
Interference with satellite navigation over the Baltic, the eastern Mediterranean and the Gulf has become routine rather than exceptional, to the point that aviation authorities issue standing advisories and airlines plan around it. The reporting is about aircraft, because that is where the safety case is sharpest. The infrastructure consequence is broader and gets less attention.
What actually depends on this¶
For infrastructure, GNSS serves mainly as a time distribution system that happens to also give you position, and it is the cheapest source of traceable time that exists. A receiver costs very little and yields nanosecond-grade time anywhere with a view of the sky, which is why it ended up underneath so much.
Mobile networks need tight synchronisation between base stations, and tighter still for the time-division modes. Electricity grids use synchronised measurement to work out what is happening across a region, and a phase-angle measurement is meaningless without a common clock. Financial venues are required to timestamp to traceable sources. Broadcast, industrial control and most of the measurement equipment in this trade carry the same dependency, usually undocumented.
The failure mode that matters is not loss of signal. Loss is noisy and obvious, and a system that notices can act. Spoofing is the problem: a receiver presented with a stronger, coherent, wrong signal will report a confident, wrong answer. Downstream, a system that assumed its clock was correct begins making consistent decisions on false data, and nothing in the stack is instrumented to catch that, because the input was never previously hostile.
What it costs¶
Holdover, and holdover is a line item.
The engineering answer is well understood: keep an oscillator good enough to coast when the reference is unavailable or untrusted. The choices run from ordinary oven-controlled crystals through rubidium up to caesium, and the difference between them is roughly the difference between coasting for hours and coasting for months. Price tracks that span steeply, which is why the capability is usually absent.
The second cost is that you must now decide whether to believe a reference, which is a problem class the trade is better at than it realises. Compare multiple constellations. Compare against the local oscillator and reject a step that physics does not permit. Compare against a terrestrial source. Treat time as an input requiring corroboration rather than a fact, which is how a careful system treats every other input arriving over a network.
None of this is novel engineering. It is standard practice in one or two industries and essentially absent everywhere else, and the reason is that it costs money to defend against something that has historically never happened.
What it makes possible¶
The constructive reading is that this forces an overdue correction, and the result is better systems than the ones we have.
A system that treats time as an attested input rather than an assumption is more robust against every failure, not only deliberate ones. Receiver faults, antenna problems, firmware bugs and solar events all produce wrong time, and a design that corroborates catches the lot. The adversarial case is simply the one that finally justifies the work.
It also pushes towards distributed timing that does not depend on a single provider. Terrestrial time distribution, time over fibre between known endpoints and mutual comparison between peers are all workable. A mesh of modest clocks that agree with each other is more resilient than a hundred excellent clocks all listening to the same satellite. That is the same architectural argument this notebook has made about registries and about routing, arriving in the time domain.
The wider benefit is sovereignty in the practical sense rather than the rhetorical one. A country, a hospital or a grid operator that can keep accurate time without a foreign military signal has removed a dependency it probably did not know it had. The equipment to do that amounts to a decent oscillator and the discipline to specify it.
Who owns the reference¶
Every global constellation is a state asset operated by a military or a space agency: the American, Russian, Chinese and European systems, with regional systems besides. The civilian signal is a courtesy. It is unauthenticated by design in its basic form, it can be degraded regionally and the operators retain the ability to do so.
That is the dependency in one sentence. A large share of civilian infrastructure takes its clock from a signal controlled by foreign militaries. The signal is free, unauthenticated and trivially overpowered by a transmitter costing very little. It has worked for decades, which is why nobody specified an alternative.
Authenticated civil signals are arriving and are a real improvement, since they make spoofing substantially harder. They do not address jamming, they require receivers that support them and the receiver fleet is long-lived. The replacement cycle is measured in decades.
The small-operator position is the usual one. A large bank or a national grid can afford caesium and a terrestrial backup. A regional hospital, a water utility or a four-person company running something that matters cannot, and will discover the dependency during the event rather than before it.
Here at AxisOps our position is that time belongs on the dependency list with everything else. Write down where yours comes from, what happens when it is wrong rather than absent, how long you can run without it and how you would know. That is an afternoon of work and almost nobody has done it, including most organisations that would describe themselves as critical national infrastructure.
The measurement we have not taken¶
We do not have a figure for how long our own estate holds usable time with the sky removed. We know the answer is worse than we would like and better than nothing, and that it depends mostly on parts chosen for other reasons. It is a cheap experiment: disconnect the antenna and watch the offset. We have not run it, and the number would be worth more than the argument above.