Compromised landmarks can falsify measurements

A party that controls landmark servers can report false timing. Brass and Aarne cite research in which manipulating a third of the landmarks shifted the estimated location by about 700 km ¹. Avellar and Grunewald note that compromised landmarks let adversaries spoof travel-time measurements directly ⁴. The draft specification asks verifiers to require anchors in diverse places, run by several independent operators ¹⁰.