In the most recent edition of the Institute of Navigation's Journal "Navigation," Humphries and a colleague explain over the course of 16 pages how it was done. From the paper's abstract:
"An attacker's ability to control a maritime surface vessel by broadcasting counterfeit civil Global Positioning System (GPS) signals is analyzed and demonstrated. The aim of this work is to explore civil maritime transportation's vulnerability to deceptive GPS signals and to develop a detection technique that is compatible with sensors commonly available on modern ships. It is shown that despite access to a variety of high-quality navigation and surveillance sensors, modern maritime navigation depends crucially on satellite navigation and that a deception attack can be disguised as the effects of slowly-changing ocean currents …"
But bad actors need not be able to penetrate the complex formulas of this technical paper in order to pose a significant hazard to shipping. At the annual Defcon hackers' convention in 2015 a Chinese technologist gave step by step instructions on how to build a GPS spoofing device and was selling kits for $300.
