A newly published academic study reveals that nearly half of all communication satellites in geostationary orbit transmit civilian and military data without any encryption. This finding highlights a critical weakness not only in communication technologies but also in the context of modern cyber-intelligence operations. With the rapid evolution of SDR (Software Defined Radio) technologies, these unencrypted signals can now be intercepted and decoded with low-cost receiver hardware.

Technical Findings and Observations

The analysis was conducted by collecting signals across the C-band and Ku-band frequency ranges used by 39 geostationary satellites. Researchers developed entropy-based classification algorithms to identify carriers transmitting unencrypted data. Carriers with lower spectral density typically contained VoIP sessions, SIP signaling, DNS traffic, and text-based command packets.

For data processing, open-source satellite telemetry solutions such as the OpenSatelliteProject were used. After demodulating QPSK and 8PSK signals at the physical layer, MPEG-TS streams or raw IP packets were extracted for higher-layer protocol analysis. The investigation successfully recovered the following categories of content:

Mobile carrier traffic: SMS message text, SIP session details (INVITE, 200 OK, BYE), IMSI/IMEI associations.
In-flight internet protocols: DHCP, DNS, HTTP GET/POST requests, captive portal logs.
Corporate internal network data: VLAN-tagged broadcast packets, WINS queries, LDAP and SMB traffic.
Military/police communication: Plaintext coordinates and operational messages transmitted through internal IP-trunked radio systems.
SCADA and energy control systems: DNP3, Modbus-TCP and SNMP traffic exposing status variables and command-response sequences.

Much of this data contains sensitive personal, corporate, and state-level information, making it highly exploitable.

Structural Causes Behind the Vulnerability

The question of why such critical data is transmitted without encryption is rooted in legacy design assumptions and system architecture choices. Most satellite service providers delegate encryption to customers at the application layer. In other cases, constraints such as limited processing capabilities and latency concerns have resulted in the omission of real-time link-layer encryption.

Even when encryption is technically supported, it is often disabled due to configuration mistakes, cost-driven decisions, or operational convenience. Older terminals—such as early-2000s VSAT modems—frequently lack cryptographic support altogether, or the feature was never deployed. This leads to large-scale broadcast transmission of plaintext signals across the footprint.

Intelligence and Security Impact

This is not merely a data security flaw; it creates a strategic surveillance advantage. State-sponsored threat actors can passively monitor these signals in real time, gaining insights such as:

Passive tracking of operational military movements
Mapping weaknesses in critical infrastructure (e.g., SCADA failure and load data)
Observing financial institution communication patterns
Correlating mobile network user behavior
Analyzing pre-VPN corporate traffic to identify attack vectors

Such information is valuable not only for technical exploitation but also for diplomatic, political, military, and economic intelligence.

Cyber-Intelligence Perspective

The assumption that “no one is listening” to satellite downlinks is no longer valid. Sky-borne data traffic is vulnerable to actors ranging from low-profile intruders to advanced persistent threats (APTs). Encryption is no longer optional—it is the minimum security baseline. In modern threat environments, securing both the network and the broadcast frequency layer is essential. For critical infrastructure, defense systems, and financial services, satellite communication should be treated like an open Wi-Fi network: if it is unencrypted, it is being monitored.

Institutional security strategies must assume that satellite-transmitted data is insecure by default and adopt a multi-layer encryption model from the physical layer upward.

Conclusion

This vulnerability in satellite communication is not simply a technical problem; it is the result of a neglected security culture. In the coming years, more governments and private organizations will inevitably have to prioritize this issue—updating existing systems, securing transmission layers, and adopting a “security-by-default” approach in new communication infrastructures.