Researchers reverse engineered SpaceX’s satellite signals to create a new GPS service

With thousands of satellites now in orbit Elon Musk’s Starlink space internet constellation is easily the largest in history and of course presents an immense opportunity for global connectivity. But as researchers elsewhere use new technologies, such as quantum sensors, to eliminate GPS satellites all together, elsewhere other researchers have shown how its signals could also be analyzed and used as an alternative to traditional GPS, a new paper claims - with or without SpaceX’s blessing.

Todd Humphreys and his team at the University of Texas Austin dove into the “signal structure” of the Starlink downlink, and while there’s only so much they can learn without insider info from the company itself, they did find plenty of useful data.

Satellites must pass their signal down to the ground at some point, and in Starlink’s case it’s pretty much a constant stream. That doesn’t mean anyone can just tap in, though — the signal itself is structured and encoded in a proprietary way that, presumably, SpaceX has decided is best for the kind of orbital broadband it’s providing.

The exact parameters of this signal are not known, but in order to make sure packets are arriving in order and intact, the transmission — like any data transmission these days — includes very precise timing data and other telemetry so the receiver and sender can stay in sync.

By carefully analysing an incoming signal from a single satellite and combining that data with what is known about the satellite’s exact position, the time down to the nanosecond, and so on, Humphreys was able to decode the transmission to a certain extent. They document their results in a paper, currently awaiting peer review and publishing.

A side effect of having precise telemetry coming from a few satellites - in addition to other measurements like Doppler radar -  is that you can use it to work out your exact location, and the paper describes how this might be done.

As The Register points out, this idea isn’t new and in fact was being pursued as a possibility years ago, but ultimately SpaceX, Starlink’s owner, decided to focus on the consumer side of things. But the scientists at UT Austin had had a taste of the possibilities and decided to pursue it independently with its own rig without SpaceX cooperation.

As they write in the paper’s intro: “The signal characterization offered herein includes the exact values of synchronization sequences embedded in the signal that can be exploited to produce pseudorange measurements. Such an understanding of the signal is essential to emerging efforts that seek to dual-purpose Starlink signals for positioning, navigation, and timing, despite their being designed solely for broadband Internet provision.”

To be clear, no one is accessing Starlink user data here. The sync sequences are just strings of timings and other data that the machines use to stay in touch — the payload data is entirely separate.

In the paper, due to the fact that the signal was being targeted at an actual Starlink user terminal, the location had to be for that terminal too, and they were able to get it within 30 meters. Not better than GPS, obviously, but it could be quicker and eventually more accurate if SpaceX were to give the project its blessing.

A software update that slightly adjusts how the satellites send their signals and a bit of data on correcting for variance between their clocks, and Humphreys suggests Starlink transmissions could be used to locate oneself to within a meter.

It would be a public service and wouldn’t cost SpaceX much of anything to implement, but it’s also a valuable service that no business in its right mind, especially one that just committed to a deeply unprofitable connectivity deal in Ukraine, would just implement and provide for free. That said, it may be that the genie is out of the bottle — the data in the paper “illuminates the path” to this use, and someone might find a way to make it work no matter what anyone at SpaceX says or wants.