Those attending ENC 2026 are fully aware of the growing RF and cyber threats to GNSS. A world in which GNSS is routinely degraded, disrupted, deceived, or denied impacts critical infrastructure owners and operators across multiple sectors and seriously affects nearly every country’s national defense. A reliable augmentation to traditional GNSS is necessary to mitigate these growing threats.
This presentation will look at the performance of a complementary PNT service from low-Earth orbit (LEO), including in an environment where GNSS has been intentionally compromised. Specifically, this briefing will focus on how the LEO PNT service from Iridium performed at Jammertest 2025 in Andøya, Norway on different manufacturers’ user equipment during deliberate GNSS attacks (e.g., jamming, spoofing, meaconing, etc.).
Performance parameters of the LEO PNT service (e.g., signal strength, burst rate, number of satellites in view, etc.) will be presented along with various performance comparisons against signals from GPS and other GNSS. Insights about the ability of user equipment to detect GNSS disruption and manipulation and automatically switch to LEO PNT will be included.
The data will show how a space-based complementary PNT service from LEO can continue to provide an accurate and stable source of time for timing sync applications when GNSS signals are impaired, falsified, or disabled.

There are multiple challenges when using low earth orbit (LEO) satellites for Positioning, Navigation and Timing (PNT). Because of the small visible footprint of a LEO satellite, compared with the Medium Earth Orbit (MEO) Global Navigation Satellite System (GNSS) satellites, many more satellites are needed in a constellation to provide global coverage. Moreover, when operating in at L-band, LEO satellites can be affected by jamming as the other GNSS signals. This paper discusses challenges and opportunities of making a viable business case for operating commercial PNT services using satellite signals of opportunity.

Much research has been done on leveraging LEO SATCOM constellations operating at Ku-band and Ka-band for PNT. Since these satellites provide “signals of opportunity” (SoOP) these make an attractive business case for also using them for PNT. However, using these broadcast SATCOM signals to provide useful time of arrival (TOA) and/or frequency of arrival (FOA) observations for PNT also faces challenges. First the SATCOM constellations are not designed to have multiple signals in view simultaneously, so the PNT operation is generally reliant on tracking the doppler from the frequency of arrival (FOA) observations as a satellite “transits” over the sky. However, testing has shown that some SATCOM satellites adjust their carrier frequency offset and sample clock offset onboard the satellite, a common technique used to reduce the doppler effect on the signal received in a satellite beam. For example, this technique is specified for Non-Terrestrial Networks (NTN) in the 3GPP standards to make these signals more emulate signal from a terrestrial tower for User Terminals. However, this sample clock and frequency adjustment means that the TOA and FOA observations extracted from the SATCOM signals are no longer directly related to the satellite pseudo-range or the doppler from the satellite “transit” compromising the potential use of these uncorrected signals for navigation.

The PNT as a Service (PNTaaS) solution deployed by NAVSYS Corporation, which is now operational in the US and Europe, avoids these issues by using ground monitor stations to publish both signal content and observation corrections for these satellite signals. This means that the user’s PNT solution is unaffected by sample clock or clock frequency offsets on the SATCOM satellite’s payload. Also, by using a hybrid GEO and LEO PNT solution, the number of satellites needed in view from a LEO constellation are significantly reduced. In this paper we will present test results showing the performance of the PNTaaS LEO observations. Together we will show developments of antennas and RF front-end solutions that will enable compact and integrated user terminals when using Ku-band GEO and/or LEO signals for PNT. Test results demonstrating the accuracy and benefits of using these observations to provide a hybrid GEO and LEO PNT solution are presented. We also provide observations from some of the early Ka-band LEO satellites to predict their suitability for use in providing PNT observations

Global Navigation Satellite Systems (GNSS) provide critical Positioning, Navigation, and Timing (PNT) services; however, they are vulnerable to interference, jamming, spoofing, and performance degradation in obstructed or degraded environments. Low Earth Orbit (LEO) broadband constellations, such as OneWeb, transmit relatively high-power downlink signals that can be exploited as Signals of Opportunity (SoOP) to enable complementary, and more resilient, PNT capability.

Given the high carrier frequency (Ku band) and rapid orbital motion of OneWeb satellites in LEO, Doppler shift measurements provide an effective range-rate observable for positioning. Existing works on the opportunistic use of OneWeb signals for positioning using Doppler measurements have mainly focused on obtaining Doppler shift information through orbit prediction models based on Two-Line Element (TLE) parameters, or through spectral approaches with simplified assumptions on the periodicity of signal structure which limits measurement accuracy and robustness. Recently published exploration of the OneWeb signal structure has revealed details of synchronisation sequences and their periodicity, enabling more precise Doppler estimation by exploiting enhanced correlation to known signal content.

In this study, the end-to-end experimental positioning using OneWeb signals of opportunity has been explored, covering acquisition with frequency domain correlation using: a multi-frame sequence; tracking, based on an Extended Kalman Filter (EKF) with Doppler and code phase states; and, positioning using another EKF.

OneWeb Ku-band downlink signals were collected at Cranfield University in a stationary scenario using a OneWeb user terminal and a software-defined radio (USRP X440) at an Intermediate Frequency (IF). The received waveform was sampled at 360 MSps, enabling capture of the full bandwidth of the OneWeb signal (250 MHz). The recorded data were processed through a delay–Doppler acquisition stage based on a two-step search strategy. An initial coarse-resolution search was used to detect candidate signal components, followed by a fine-resolution search to refine the delay and Doppler

estimates. These estimates were subsequently input to an EKF–based tracking algorithm, which continuously updated the Doppler frequency and code phase over time. The resulting tracked Doppler and code phase observables were then employed to estimate position and assess positioning performance.

Experimental results using captured operational OneWeb Ku-band downlink signals demonstrate Doppler-based positioning in the absence of GNSS aiding, achieving Hz-level Doppler tracking accuracy and successfully calculating the positioning of a receiver under stationary conditions. The impact of signal-to-noise ratio (SNR) on Doppler tracking performance and the resulting position solution was analysed, together with the effects of satellite handovers, beam switching, and ground station transitions. These effects introduce variations and discontinuities in the Doppler and code phase observables that affect tracking continuity and positioning performance when using LEO communication signals for opportunistic user positioning.

This work was performed under and funded by the ESA NAVISP-EL1-091 “Proof-of-Concept of SOOP with Broadband SatCom Signals in the ka/Ku band” project which we designated as SATSOOP.