Methodology

Active

Design

A simulation study on real ephemeris, paired with an analytic bound that the simulation is checked against.

The pairing is the point. HYP-001 predicts a Cramér–Rao bound, so the simulation’s job is to show the estimator attains it rather than to discover what the resolution is. HYP-002 is a linear-algebra identity, so the simulation’s job is to look for a counterexample across geometry the derivation did not see. A simulation that can only confirm is not testing anything; both are set up so they can fail.

Real Starlink elements are propagated with SGP4 rather than a synthetic constellation, because the geometry is the object of study and a synthetic constellation would beg the question.

Independent and dependent variables

Role	Variable	Levels or range	Instrument
Independent	Timing measurement precision $\sigma_\tau$	1 ns, 10 ns, 100 ns, 1 μs	Swept; Gaussian noise on synthesised pseudoranges
Independent	Relay size $M$	2, 3, 5, 8, 10, 20, 50, 100, 500	Adversary model
Independent	Per-cell quota $q$	1, 2, 5	Detector policy parameter
Independent	Legitimate terminal density	1, 10, 100, 1000 per km²	Uniform placement
Independent	Ground site latitude	1.4°N to 69.7°N, plus 33.9°S	Five sites
Dependent	Horizontal position RMS error	metres	Estimator output vs. ground truth
Dependent	Apparent displacement under spoofing	metres	Estimator output vs. true position
Dependent	Relay detection rate and identities caught	fraction	Detector output
Dependent	False-positive rate	fraction	Detector output on honest population
Controlled	Constellation, epoch, elevation mask, link budget, seed	Fixed per run	Archived TLE, source constants
Nuisance	Terminal clock bias	Fixed offset per session	Estimated jointly, not assumed away

Estimating the clock bias rather than assuming it away is not a nuisance control but the mechanism under test: the bias column is what absorbs the spoofer’s offset.

Baseline

A comparison with no named baseline is not a comparison.

Claim	Baseline	Why it is the fair one
Estimator efficiency	The Cramér–Rao lower bound from the Fisher information of the same observation model	The strongest possible baseline: no unbiased estimator can beat it, so attaining it means the estimator is not the limiting factor
Satellite selection	Selecting the six highest-elevation satellites	The intuitive choice, and the one an implementer would reach for first
Spoofing immunity	Zero, exactly	The prediction is an identity, so the baseline is the identity itself; anything non-zero refutes it

There is no prior geometric method for the Sybil-bounding claim to compare against — the literature study that produced this project found none — so the detector is characterised against its own operating envelope rather than against a competitor. That is a real weakness and is stated in limitations.

Measurement and uncertainty

Position error is reported as RMS over Monte Carlo trials at each $\sigma_\tau$ , aggregated across 96 epochs spanning a full orbital period, so the figure covers the geometry distribution rather than one favourable moment.
Spoofing displacement is reported as the worst case across all 384 attempts, not the mean. A mean would hide exactly the counterexample the test exists to find.
HDOP is reported as min, median and max across epochs rather than a single value, because its spread is the finding in the selection comparison.
Randomness is a hand-rolled seeded xorshift64* with Box–Muller, chosen over a crate so that a seed reproduces identical noise across machines and across dependency updates.

Analysis plan

Written before the data existed, and one part of it changed after seeing results. The change is recorded rather than quietly applied.

Sweep $\sigma_\tau$ ; compare empirical RMS against CRLB; ratio near 1 supports HYP-001.
For every epoch and aim point, apply the spoofer’s best uniform offset and record displacement; any value above floating-point noise refutes HYP-002.
Sweep relay size against quota; report detection rate and fraction caught.
Sweep honest density against $\sigma_\tau$ ; report false positives.
Repeat the whole evaluation on an independently derived element set.

Recorded change. The detector originally quantised position fixes onto a fixed grid of pitch $\delta$ and flagged over-occupied cells. On 200 relayed identities the modal cell held only 45 of them, because fixes scatter with standard deviation of order $\delta$ and a relay at an arbitrary offset straddles cells. Detection was changed to density-based — count fixes within $2\delta$ , then merge overlapping dense neighbourhoods — which is translation-invariant and has no boundary artefact. This was a correction to a flawed instrument, not a change made to improve a result, and it was found by a test failing rather than by inspection.

Threats to validity

Threat	Type	Mitigation	Residual risk
Results are an artefact of one constellation snapshot	External	Entire evaluation repeated on an independently derived element set at a later epoch, from a different orbit-determination pipeline	None material; every headline figure reproduced
Results hold only at one latitude	External	Repeated at five sites from 1.4°N to 69.7°N	None material; HDOP varies only 1.01 to 1.10
Simulation does not model real beam hopping, scheduling or proprietary handover	External	Not mitigated	Live. Stated in limitations; the evaluation is simulation on public ephemeris and does not claim operational validation
Noise model parameters chosen to flatter the result	Construct	$\sigma_\tau$ swept across three decades rather than fixed, so the result is an envelope	Low; a reader disputing a value disputes a region of a reported curve
Estimator implemented to match its own bound	Internal	CRLB derived from the observation model independently of the solver; the solver is generic Gauss–Newton	Low
Theorem verified only where it was derived	Internal	Checked across 96 epochs of live geometry the derivation never saw, plus a separate algebraic assertion that $(\mathbf{H}^\top\mathbf{H})^{-1}\mathbf{H}^\top\mathbf{1} = \mathbf{e}_3$	Low
Test suite passes vacuously	Internal	Confirmed the suite can fail by breaking the clock column and observing the Theorem 1 test go red	Low