The Numbers Station in the Sky

For 19 years, every GPS satellite has been broadcasting encrypted data in plain sight. A 176-bit field on the L1 C/A signal, officially designated Subframe 4, Page 17, carries military ciphertext to billions of receivers. The specification says it's for "special messages at the discretion of the Operating Command," but the reality is far more interesting.

Researchers at University College London built a Julia pipeline to extract bits from 12.16 million observations between 2007 and 2026, storing them in DuckDB. Their analysis, published in the May/June 2026 edition of Inside GNSS, reveals a hidden cryptographic network.

Statistical Analysis: Random Noise with Structure

The team calculated marginal entropy using a compression model trained on the data. The results matched a synthetic random baseline almost perfectly. By every statistical measure, the GPS messages are indistinguishable from random data. But there are structural exceptions.

First, placeholders: satellites frequently broadcast 22 bytes of 0xAA (binary 10101010), a standard hardware test pattern. This means no operational payload is loaded.

Second, identical high-entropy strings appear across messages months apart. For example, LY47IRP16 appeared in messages nine months apart. These are likely protocol headers leaking through encryption, enabling fingerprinting of key-distribution events.

Third, coordinated fleet-wide changes: on 26 May 2011, all 31 active GPS satellites switched to the 0xAA placeholder within hours. After that, rotation rate shifted from every 3.7 days to 1.8 days.

OTAD: Over-the-Air Distribution

This rapid daily change matches the rollout of the U.S. Over-the-Air Distribution (OTAD) network. Authorized military receivers use a Secure Availability Anti-Spoofing Module (SAASM) to get jam-resistant signals. Previously, keys required physical plug-in devices. OTAD sends the "next black key" over the L1 C/A signal.

Systemic Impact on Civilian Infrastructure

In May 2022, the rotation rate slowed back to 3.8 days without public notice. Then in December 2023, satellite PRN 8 began sending a four-byte prefix TEXT followed by 18 bytes of ciphertext. The purpose is unclear.

How to Access the Data

Software-defined GNSS receivers can capture the signal. The open-source Julia pipeline is available for analysis. The signal passes overhead twice daily.

Code Example: Extracting Subframe 4, Page 17

Using the Julia pipeline:

using DuckDB

# Connect to the database
con = DBInterface.connect(DuckDB.DB, "gps_archive.duckdb")

# Query all messages from 2025
results = DBInterface.execute(con, """
    SELECT timestamp, prn, payload
    FROM messages
    WHERE subframe = 4 AND page = 17
      AND year >= 2025
    ORDER BY timestamp
""")

for row in results
    println(row.timestamp, " ", row.prn, " ", row.payload)
end

Traffic Analysis Opportunities

For security researchers, this dataset is a goldmine: a globally deployed cryptographic network in plain sight, suitable for traffic analysis and structural cryptanalysis. The researchers invite the community to audit these signals.

Why It Matters for Developers

Understanding that GPS signals carry hidden encrypted payloads affects any system relying on GPS for timing or location. Civilian receivers may be vulnerable to spoofing or denial-of-service if the encrypted channel is misused. Developers building critical infrastructure should monitor this space.

Next Steps

Download the open-source Julia code from the UCL repository. Set up an SDR to capture L1 C/A signals. Start analyzing the bytes.