The time is Brazilian, the signal is foreign

Almost every automated decision in the modern economy has to agree on two things before anything else: where something is and when something happened. Both answers come from space, through signals no one in Brazil controls and anyone can receive for free — which is at once the greatest strength and the greatest problem of these systems.

The more visible use is position. A ride-hailing or delivery app does not merely show the user a map: it treats the coordinate as evidence. It is the position reported by the device that determines whether the driver was inside the surge-pricing zone, how far the trip ran, whether the delivery arrived. That turned the satellite signal into contractual evidence — and, like all evidence, it became a target. In April 2025 US authorities charged an organized scheme that combined location spoofing with stolen identities to defraud several ride-hailing and delivery platforms at once, with rides claimed from dozens of kilometers away from the driver’s real position.

The less visible use is time, and it holds up more. It comes from the global navigation satellite systems — the constellations that provide positioning, navigation and timing, known by the acronym GNSS: America’s GPS, Europe’s Galileo, Russia’s GLONASS and China’s BeiDou. Every satellite in those constellations carries atomic clocks, and it is from them that a telecommunications site, an electrical substation or a trading system obtains a common reference without maintaining an atomic standard of its own.

Distributed networks do not only need to agree on the data; they need to agree on the order in which events happened. Without common time there is no ordering — and without ordering there is no record that holds up.

With those two dependencies in view, the rest of this piece deals with a single question: what happens when the signal goes away.

The failures stopped being hypothetical

They became a time series.

IATA records a 220% increase in GPS signal-loss events in civil aviation between 2021 and 2024. EUROCONTROL estimates that up to 38% of European en-route air traffic crosses regions affected intermittently but regularly by radio-frequency interference. On 26 March 2026, EASA and EUROCONTROL published the first joint action plan dedicated to the subject, with 22 actions. On 3 July, EASA published the fourth revision of its safety bulletin on GNSS outages and alterations, describing incidents that are more severe, more sophisticated and more disruptive.

Four revisions of the same bulletin in three years is the behavior of a regulator running behind the problem, not ahead of it.

The case that changed the nature of the risk

Until 2026, the working assumption was that interference came from the ground: a cheap transmitter, limited range, a locatable origin.

Work by Todd Humphreys and Zach Clements, of the University of Texas, dismantled that premise. Receivers spread across Europe — from Svalbard to Spain — had been recording, since 2019, the same total signal blackout at the same instant, in bursts of three to five seconds. The affected area was far too large for any ground transmitter; the geometry placed the source at least 1,200 km up.

Raw recordings from stations in Amsterdam and Trondheim made it possible to time the signal’s arrival to within five meters and identify a culprit: Cosmos 2546, a Russian early-warning satellite for ballistic missile launches. It operates in an elongated elliptical orbit, designed so that the satellite spends much of its time hovering over high northern latitudes — which is precisely what explains the duration and the geographic reach of the bursts. The result was published in the journal Navigation under the title Chasing Lightning, and reached a wider audience through a Veritasium documentary in June 2026.

Translated into boardroom language: interference stopped being a perimeter problem. Against a ground transmitter there are local countermeasures — directional antenna, shielding, triangulation, police. Against a source in orbit more than a thousand kilometers up, hitting an entire continent in bursts of seconds, what remains is whatever you built beforehand, inside your own house.

Where official time comes from

Here lies an asymmetry that is rarely discussed.

Brazilian Legal Time is the responsibility of the National Observatory. The legal basis goes back to Law 2,784 of 1913 and Decree 10,546 of the same year, reinstated by Decree 4,264 of 2002. The Observatory’s Time Service Division is the institution legally responsible for generating, keeping and disseminating the national reference, realized from atomic standards — a set of cesium and hydrogen clocks. Internationally, this connects to UTC, computed from the contribution of hundreds of atomic clocks maintained by laboratories in several countries.

In other words: Brazil has its own time, with a statute, an institution and an atomic standard. What the country lacks is adequate distribution of that time reaching critical infrastructure at scale. In practice, the financial and power sectors synchronize through foreign constellations.

It is worth separating the three ways of obtaining and maintaining a reliable time reference — because each fails differently and is protected with different money.

Local time and frequency standards. Cesium, rubidium or hydrogen atomic clocks kept on site. They sustain the time scale on their own for long periods, but require traceability and calibration against UTC and Brazilian Legal Time.

GNSS signals. Beyond position, these constellations distribute time with very high precision, and a receiver can discipline a local clock. What matters is what this is not: GNSS is a means of transferring time, not the legal definition of Brazilian Legal Time.

Remote references over a network. NTP and other certified synchronization services, or dedicated links to the National Observatory, which offers dissemination, certified synchronization and timestamping tied to Brazilian Legal Time.

The rules already oblige you to depend

This is not a good practice someone may adopt. Rules from sectors that never speak to one another make the dependency mandatory.

In the power sector, Submodule 11.8 of the ONS Network Procedures, covering the Synchrophasor Measurement System, requires measurements to be synchronized by GNSS — “for example GPS”, transmitted at 60 frames per second, with a UTC timestamp and a maximum total vector error of 1%. The measurement unit itself is described as comprising a GPS receiver, an acquisition system and a microprocessor.

In capital markets, Article 17 of CVM Resolution 135, of June 2022, requires organized market administrators — exchanges and over-the-counter markets — to synchronize the clocks they use “adopting the UTC standard”, and delegates to the CVM itself the task of establishing the accuracy and precision of the timestamps.

The equivalent European rule, MiFID II’s RTS 25, publishes the number: a maximum divergence from UTC of 100 microseconds for venues with gateway-to-gateway latency below one millisecond, and one millisecond otherwise, with documented and auditable traceability.

The rule reaches down to the participant. The B3 Access Manual establishes, among its technical requirements, that participants adopt a procedure for synchronizing clocks with Brazilian Legal Time and store the information in UTC, with accuracy and precision determined by B3. The over-the-counter regulation in force in 2026 repeats the requirement.

Note the chain: the rule orders synchronization with Brazilian time, and the practical means of doing that at scale, today, is a receiver of a foreign signal.

Three layers usually treated as one

The discussion mixes what is worth separating, because the exposure may sit in any of them:

Time reference — where the second comes from. This is where the three options above apply.

Time distribution — how that second travels from the source to the equipment that stamps the record. Cable, network, protocol, receiver.

Timestamp representation — the format in which the time is written and later audited. It is the only one of the three that Brazilian rules specify clearly: UTC.

An organization can be perfectly compliant in the third layer, reasonable in the second and completely exposed in the first — and documentary compliance does not reveal that.

The antenna on the roof

If the dependency still seems abstract, it has an address and a price.

The B3 Co-location Services Commercial Policy, in its section on leasing space for GPS antennas, provides that B3 permits the installation of such antennas exclusively on the roof of its own data center, for signal reception and distribution of synchronization services. The procedure requires a technical inspection, a project submitted to B3, approval, contracting of the service and signature of an authorization term. The receiver is hosted in the contracting party’s own rack — there is even a GPS Rack category. The price of the antenna space is tabulated according to the contracting party’s profile.

That deserves a slow reread. The Brazilian exchange maintains a commercial product whose purpose is to give each participant its own view of the sky. This is not negligence — quite the opposite: it is the recognition, priced and contractualised, that time is a critical input and that each participant should fetch it at the source. What the arrangement does not solve is the next question: what happens when the entire sky is unavailable at once, for every rack in the building?

And the fibre falls too

The predictable objection is that the cable will always be there. Recent experience — in Brazil included — counsels caution.

On 6 September 2025, simultaneous cuts in the Red Sea hit the SMW4 and IMEWE cables, degrading traffic between Asia, the Middle East and Europe. In the Baltic, around ten cables have been damaged since 2022, seven of them between November 2024 and January 2025. An analysis of 44 damage events across 32 distinct episodes in 2024 and 2025 points to three factors that amplify the impact: lack of redundancy, lack of route diversity and limited global repair capacity.

Brazil offers examples of the same problem at another scale. On 13 May 2024, the rupture of a subfluvial fibre in the Solimões River affected internet and telephony in Manaus, Manaquiri, Careiro Castanho and Autazes. At that moment three cables serving the state were faulty — two coming from Pará and one from Porto Velho — and Manaus kept part of its connectivity thanks to the alternative route of the Tucuruí transmission line.

In March 2023, the rupture of the SAM-1 submarine cable, on a branch some 30 km off the coast of Salvador, produced instability across several states. Telxius had to bring a maintenance ship to Brazil and told providers full stabilisation could take up to 30 days. The cause was not vandalism: it was wear on a 23-year-old cable. Small providers were the hardest hit.

That point changes the boardroom conversation. It is not about whether fibre can fail — it can. It is about how long a critical infrastructure can operate without that route, and how many days separate the break from the arrival of the ship.

And time distribution over fibre, the natural technical alternative to GNSS, inherits exactly this class of risk. Fibre removes the dependency on a radio signal from space, but introduces dependency on physical route, power, intermediate equipment, civil works and repair capacity. Swapping GNSS for fibre does not solve the resilience problem: it moves the domain of failure.

How other countries treat the problem

The most revealing difference between Brazil and the countries that took up the subject is not in the diagnosis. It is in treating it as critical infrastructure policy, with a decision, a deadline and a budget.

In the United States, Executive Order 13905, of February 2020, defines “responsible use of positioning, navigation and timing (PNT)” as deliberate, risk-informed use, and directs the Department of Commerce to make available a source of Coordinated Universal Time independent of GNSS for critical infrastructure operators. The United Kingdom structured a national positioning and timing program with £155 million earmarked for a sovereign eLoran system — a terrestrial reference, under national control, with initial capability due in 2028 and full capability in 2030.

What the two cases have in common is not regulation of whoever uses the signal: it is the deliberate constitution of a second source.

The claim I stand behind

By 31 December 2028, no Brazilian rule will require a time source independent of GNSS for critical infrastructure operators. Not ONS, not the CVM, not Anatel.

If I am wrong, good: it means the subject reached the regulatory agenda. If I am right, the country will have spent a decade regulating the dependency without regulating the alternative.

Four questions for the next risk committee meeting

If you sit on a board or committee in a regulated sector — financial, power or telecommunications — four questions belong on the next agenda.

Where, on our risk map, are position and time? Not as an infrastructure item, but as a process input: which of our decisions take a coordinate or a timestamp as truth? If the answer is “nowhere”, the map has a hole the size of a sector rule.

Which of the three layers are we exposed in? Reference, distribution or representation. Documentary compliance tends to cover the third and say nothing about the first, and it is entirely possible to be audited and unprotected.

How many hours does the operation sustain without the external signal, and what does buying those hours cost? A local reference clock, distribution over our own optical network, certified synchronization from the National Observatory and periodic drills operating without satellite all have catalog prices — B3 even prices the space on its roof. Knowing the price is what turns concern into a capex decision.

Who answers for this in here? If the answer is “engineering”, the subject is in the wrong place. A mandatory dependency, imposed by regulation, on an asset operated by another country is a board matter — and the moment to find that out is not during a five-second burst.