The civilian C/A code isn't protected at all. A modern spoofing attack works by initially providing the target with the same GPS signal that the target is alre

The civilian C/A code isn't protected at all. A modern spoofing attack works by initially providing the target with the same GPS signal that the target is already reading. By "same" I mean phase-correct for that target in that position and time. Then the magnitude of the spoof signal is increased such that the target's tracking loops will follow the spoof signal instead of the real signals. Finally, the spoof signal is slewed in either space or time to drive the target's position or time estimate to where the attacker wants it to be. There are a few anti-spoofing defenses available right now, but they are either expensive or ineffective. If the target has a high-quality inertial navigation system or clocks, then the slew rate available to the attacker is greatly reduced. There are also some defenses related to DGPS, but they require a separate base station and communication side-channel to execute. Right now, the hardware cost to deploy an advanced attack like that is relatively cheap, and subject to Moore's Law. A GNU Radio USRP could do it right now, for example. The hardware cost to defend against it is expensive, and not getting any better. Changing the signal structure to incorporate cryptographically strong authentication is the only solution I can see to swing the pendulum back the other way.