Starlink signals can be reverse-engineered to work like GPS—whether SpaceX likes it or not
Todd Humphreys's offer to SpaceX was simple. With a few software tweaks, its rapidly growing Starlink constellation could also offer precise position, navigation, and timing. The US Army, which funds Humphreys's work at the University of Texas at Austin, wanted a backup to its venerable, and vulnerable, GPS system. Could Starlink fill that role?
When the idea was first proposed in 2020, executives at SpaceX were open to the idea, says Humphreys. Then word came from on high. Elon told the leaders we spoke to: every other LEO [low Earth orbit] communications network has gone into bankruptcy," Humphreys told MIT Technology Review. And so we [SpaceX] have to focus completely on staying out of bankruptcy. We cannot afford any distractions."
But Humphreys wouldn't take no for an answer. For the past two years, his team at UT Austin's Radionavigation Lab has been reverse-engineering signals sent from thousands of Starlink internet satellites in low Earth orbit to ground-based receivers. Now Humphreys says his team has cracked the problem, and he believes that regular beacon signals from the constellation, designed to help receivers connect with the satellites, could form the basis of a useful navigation system. Crucially, this could be done without any help from SpaceX at all.
In a non peer-reviewed paper published on arXiv, Humphreys claims to have provided the most complete characterization of Starlink's signals to date. This information, he says, is the first step toward developing a new global navigation technology that would operate independently of GPS or its European, Russian, and Chinese equivalents.
The Starlink system signal is a closely guarded secret," says Humphreys. Even in our early discussions, when SpaceX was being more cooperative, they didn't reveal any of the signal structure to us. We had to start from scratch, building basically a little radio telescope to eavesdrop on their signals."
To get the project started, UT Austin acquired a Starlink terminal and used it to stream high-definition tennis videos of Rafael Nadal from YouTube. This provided a constant source of Starlink signals that a separate nearby antenna could listen in on.
Humphreys quickly realized that Starlink relies on a technology called orthogonal frequency-division multiplexing (OFDM). OFDM is an efficient method of encoding digital transmissions, originally developed at Bell Labs in the 1960s and now used in Wi-Fi and 5G. OFDM is all the rage," says Mark Psiaki, a GPS expert and aerospace professor at Virginia Tech. It's a way to pack the most bits per second into a given bandwidth."
The UT Austin researchers did not try to break Starlink's encryption or access any user data coming down from satellites. Instead, they sought out synchronization sequences-predictable, repeating signals beamed down by the satellites in orbit to help receivers coordinate with them. Not only did Humphreys find such sequences, but we were pleasantly surprised to find that they [had] more synchronization sequences than is strictly required," he says.
Each sequence also contains clues to the satellite's distance and velocity. With the Starlink satellites transmitting about four sequences every millisecond that's just wonderful for dual use of their system for positioning," says Humphreys.
If the terrestrial receiver has a good idea of the satellites' movements-which SpaceX shares online to reduce the risk of orbital collisions-it can use the sequences' regularity to work out which satellite they came from, and then calculate the distance to that satellite. By repeating this process for multiple satellites, a receiver can locate itself to within about 30 meters, says Humphreys.
If SpaceX later decided to cooperate by including additional data on each satellite's exact position in its downlinks, that accuracy could theoretically improve to less than a meter-making it competitive with GPS. SpaceX did not respond to requests for comment.
Other researchers have been treading a similar path. Zak Kassas is a professor in the department of Electrical and Computer Engineering at Ohio State University and the director of a US Department of Transportation center focusing on navigation resiliency. Last year, his team was the first to demonstrate that Starlink signals could be used for positioning, in part using machine learning.
Kassas's approach, which he calls cognitive opportunistic navigation, analyzes the period and changing frequencies of signals from a satellite as it travels overhead. The receiver also uses the synchronization sequences, learns the satellite's orbit, and tracks it. With multiple satellite passes, the receiver ultimately calculates its own location. At a recent conference, Kassas claimed his system had now achieved accuracies of less than 10 meters with Starlink. It's a framework that is so general we can apply it to any terrestrial or extraterrestrial signal," he says. It will learn on the fly, tell you what is being transmitted, and tell you where you are."
A fuller understanding of Starlink's signals has implications beyond navigation. For instance, the Starlink satellites currently don't seem to be using two of the eight channels that SpaceX is licensed for. Humphreys speculates that this could be because Musk is keen not to interfere with radio telescopes operating at neighboring frequencies. The bright streaks of orbiting Starlink satellites have already been accused of disrupting optical astronomy.
UT Austin's findings also highlight the possibility of deliberate interference with Starlink itself. Humphreys notes that while the synchronization sequences hold promise for navigation, the fact that they are utterly predictable and are used across the whole constellation is a security vulnerability. Humphreys has done a big service to the navigation community identifying these sequences," says Psiaki. But any navigation system working on open-source sequences could definitely be spoofed, because everyone will know how to spot those signals and create fake ones."
Starlink reportedly suffered a catastrophic loss of communications in late September in Ukraine, where it is being widely used for voice and electronic communications, to help fly drones, and even to correct artillery fire. Although it is unclear whether the outages were due to jamming by Russian forces, Musk tweeted last week: Russia is actively trying to kill Starlink. To safeguard, SpaceX has diverted massive resources towards defense."
Starlink has unquestionably been a lifesaver for Ukraine. However, reports of the outages and continued confusion about who will be paying for Starlink services there raise concerns over its future.
As time goes on and their dependence on Starlink deepens, Ukraine and its allies in the West are coming to appreciate that they have little control over Starlink and know little about it," says Humphreys. But now many millions have a vested interest in Starlink security, including its resilience to jamming. Assessing that security starts with a clear understanding of the signal structure."