Starlink’s Secrets Revealed – Researchers Cut Open Signal To Confirm GPS Support

Ramish Zafar
Starlink constellation render
A graphic illustrating the Starlink satellites in orbit. Image: Mark Handley/University College of London

This is not investment advice. The author has no position in any of the stocks mentioned. has a disclosure and ethics policy.

SpaceX's Starlink satellite internet service can be reverse-engineered to work as a global positioning system according to a new research paper published by researchers at the University of Texas. The research involves using a secondary dish to capture the signals while the Starlink user dish is continuously communicating with the satellites, and it also reveals other key features about the signal that travels from the satellite to the dish. These include the nature of the signal itself, SpaceX's efforts to ensure that transmission is efficient and the security features of the dish that are in place to prevent a user from accessing the raw signals to determine if the service can be used to determine the location of objects that it is transmitting to.

Starlink's Signal to Noise (SNR) Ratio Is Well Below The Levels Required For Positioning Communication

The research, originally spotted by the MIT Technology Review, takes a look at whether Starlink satellite signals can be used to also to determine position, navigation and timing (PNT) coordinates. When deciding to choose whether to use the SpaceX dish to decode the signals and use them for PNT, the researchers found out that the dish has existing security features in place that prevent them from using it as a development device.

Related StoryRamish Zafar
Apple Steals Starlink’s Lunch – Announces $450 Million Satellite Investment

Additionally, since timing is crucial for GPS, which measures the time that it takes for signals from different satellites to travel to and from a receiver to determine its location, the dish's clock that mixes the signals from the satellites was found to be unreliable.

Therefore, they decided to make their own dish for the experiment, which involved using a parabolic dish that is steerable, uses publicly shared data from SpaceX for the Starlink satellite coordinates, uses a continuous signal from the satellites to SpaceX's user dish and converts the signals from their frequencies in the 12Ghz band to those in 2.1Ghz band. To ensure that the signals were consistently available for the custom dish to 'listen' to, they made the Starlink terminal continuously download a high-definition YouTube video.

Each frame of a Starlink signal consists of details such as the satellite transmitting it and its interpretation instructions. Image: Fig. 5: Channel layout for the Ku-band Starlink downlink/Signal Structure of the Starlink Ku-Band Downlink, University of Texas At Austin.

Their inspection revealed that the Starlink signal is divided into eight channels, with each channel having a bandwidth of 240MHz. Out of these, SpaceX is using only six channels, and the two channels at the lower end are empty - which the authors assume is because they are close to the frequencies used by astronomers.

Inside each channel, the signal leaves four subcarriers empty to provide coverage for leakage, and overall, SpaceX has also reserved 10MHz of frequency as a guard band.

Using the signal for positioning involves analyzing its synchronization sequences. When traveling from the satellite to the dish, the signal uses what is called Orthogonal frequency-division multiplexing or OFDM. This splits the main signal into several smaller signals, with the dish then responsible for combining or 'synching' them upon receipt.

According to the researchers, a separate radio, such as the one that they used, can be used to predict the sync sequences, which can then be used to replicate a signal which matches or 'correlates' the variables necessary for GPS positioning. Additionally, they also discovered that the replicated signal has a strong correlation with the actual Starlink signal.

Image: Fig. 7: Channel layout for the Ku-band Starlink downlink/Signal Structure of the Starlink Ku-Band Downlink, University of Texas At Austin.

Starlink Signal Is Designed To Ensure User Dish Efficiency & Reduce Costs Say Researchers

A deeper and more thorough analysis of the signals reveals that SpaceX might be using different power levels for different user subsets and cells. A cell is a geographic region that is covered by the Starlink satellite, and different cells often deliver different download and upload speeds. Additionally, in another feature that is suitable for GPS coverage, even when there is no user demand, the satellites still beam down a minimum level of frames. This, according to the researchers, is sufficient to be both regular and dense for providing PNT coverage.

Moreover, they also discovered that since the signal characteristics are similar across satellites, the overall signal to noise ratio (SNR) of -6 dB of the positioning data is well below the threshold required for providing GPS coverage. This low ratio also means that powerful antennas are not needed for positioning coverage, and the information can also be extracted from satellites outside the cell in which the receivers are located. SNR measurements for GPS satellites have touched as high as 55 dB.

However, the synchronization sequences for the signals themselves are not the same across the thousands of Starlink satellites, which then results in difficulty in identifying the spacecraft. The researchers believe that this can be solved by combining the user and satellite combinations and the time that is taken for a signal to travel to and from a satellite.

The second-generation Starlink user terminal as visible on its website. Image: Starlink

Finally, the 10 MHz frequency guard band between channels also lets SpaceX reduce the user terminal costs as it requires less frequency filtering and gives the company the flexibility to activate multiple channels in a service cell. A key feature of the frequency is that it allows for far greater synchronization of the signal by the user terminal (which is necessary especially when the signals are coming from different satellites), and a byproduct of this, according to the researchers, is that this is also suitable for the replicated signal to produce the positioning data.

The Starlink designers have also chosen a large number of subcarriers within a bandwidth to improve the overall throughput.

This study also shows that it is easy to interfere with Starlink coverage, as the malignant party simply has to create signals with similar synchronization to the Starlink signals in order to confuse the user terminals. SpaceX is currently battling Russian attempts to jam its network in Ukraine, and according to Elon Musk, the company is dedicating vast resources and 'closing' its system as a result. One of the study's authors, Todd Humphreys, believes that studying the Starlink signals is an important first step in securing the network that has proven vital in Europe's largest conflict since the second world war.

Share this story

Deal of the Day