GNSS Spoof Risk Scoring Went Quiet on August 17. 585 Events Later, It Still Hasn't.

The Setup

Overwatch logged 1,159 gnss_spoof dark events in the 90 days ending September 18. Look at the aggregate and coverage seems workable: 45.3% of them, 525 events, carry a risk_tier. Look at the calendar and the aggregate is misleading. Every one of those 525 scored events is old. Since August 17, Overwatch has logged 585 more gnss_spoof events. Two of them, 0.34%, have a risk_tier.

The Chain

The weekly count makes the break specific. Through early August, scoring kept pace with volume: the week of June 29 scored 45 of 45 events, July 6 scored 89 of 89, July 13 scored 119 of 119, July 27 scored 183 of 191. The week of August 17, coverage collapses to 1 of 22. It does not recover: August 24 scores 0 of 117, August 31 scores 1 of 184, September 7 scores 0 of 161, September 14 scores 0 of 101. Detection didn't slow down when scoring stopped — weekly volume since the break is comparable to, and at points higher than, the scored weeks before it. Adjudication tells the same story: 4 gnss_spoof events have ever been adjudicated, all before August 17. Zero of the 585 since.

Geography sharpens it further. 635 of the 1,159 events in the 90-day window, 54.8%, cluster in a single one-degree lat/lon cell centered on the Singapore Strait. Their average kinematic_anomaly_score is 0.837, higher than the dataset's 0.772 overall mean — the Strait's spoof detections are, if anything, more kinematically anomalous than the norm, not less. Of the 585 events logged since the break, 351, 60%, sit in that same cell. Nearly all of the Strait's 250 historically-scored events predate August 17; almost none of its recent volume has a tier.

The Implication

risk_tier is the field the compliance queue and the adjudication workflow key off of. A month of the highest-traffic GNSS spoofing corridor in the dataset producing anomaly scores in the high 0.8s, with a scoring field that has stopped populating and an adjudication field that has stopped moving, means that corridor's most recent month is functionally invisible to anything filtering on tier. The volume didn't drop. The pipeline that would have surfaced it did.

What to Watch

Whether the job that assigns risk_tier to dark_events resumes on the next batch, and whether it backfills the 585-event gap or only picks up new events going forward. Whether the same freeze shows up in other dark_events subtypes — teleport events show a similar, if less total, coverage drop over the same period and are worth a follow-up pass on their own. And whether adjudication volume tracks risk_tier availability closely enough that restoring one restores the other.

Limitations

Geography here is a one-degree lat/lon rounding of last_known_lat/last_known_lon, a coarse proxy for "Singapore Strait" that likely pulls in some adjacent traffic. This does not identify why scoring stopped, only when and how completely. The exact break date is bounded to the August 17–23 week rather than pinned to a single day.

Data as of 2026-09-18. Source: Overwatch dark_events (subtype='gnss_spoof', risk_tier, kinematic_anomaly_score, adjudication_status), 90-day window; geography approximated by rounding last_known_lat/last_known_lon to the nearest degree.