Researcher Says Hidden GPS Messages May Carry Military Keys
The clue was a daylong burst of a banned 101010 signal, with timing that lines up with the start of a military system for sending new keys.
Computerphile · GPS Hidden Messages - ComputerphileOn May 26, 2011, the whole GPS constellation, about 31 satellites, stopped sending its usual random looking traffic and broadcast the same stark repetition all day, 10101010 and on. At midnight, the jumble returned, only it started changing almost twice as fast as before.
The channel where it happened is one most drivers and phone users never see. Buried in the navigation signal is a slot labeled only, "At the discretion of operating command." It is described as a text message, with nothing said about what should be inside. Ordinary smartphones and standard navigation chips ignore it completely.
A researcher who works on traffic analysis for encrypted communications, including work on the Tor anonymity project, picked it up with a software defined receiver, essentially an antenna plus computer software that can read the parts of the signal that commercial chips skip. At first glance, he said, the messages looked random, and that was what made them interesting.
His best reading of the evidence is that this obscure channel may be how the American military delivers new encryption keys to its version of GPS, though he said he is not certain and other explanations are possible. Before late May 2011, each message stayed on the air for about 3.7 days. Afterward, each one lasted only about 1.8 days. A statistical check called cumulative sum confirmed the sharp break was real, and it lined up with the advertised start of a military system for sending replacement keys by radio.
The path there ran through a hunt for weirdness. He charted thousands of messages collected since 2007 and found they were almost random, but not quite. A few were far more predictable than chance would allow, and a few were far more surprising. The most surprising ones, which he called sentinels, were all zeros, all blank spaces, and the binary pattern 101010.
Then came the turn. On that one day in May 2011, all the satellites dropped their random looking traffic and broadcast the 101010 pattern, which is not allowed under the GPS rules. At the exact start of May 27, they flipped back to random looking traffic, only rotating faster. The timing fits what was described in a presentation by what the researcher described as "someone working on the GPS system itself," who spoke about distributing new keys to receivers by radio and replacing old keys without handling the equipment.
No ordinary user would have noticed. Receivers built for position and precise time simply skip pages they do not need, though higher end units can log them for debugging. The researcher noted that similar banned patterns have caused GPS receivers to malfunction in other incidents, though he knew of no crash in this case.
The operators never mentioned the daylong burst or the faster rhythm that followed, even though they publish daily bulletins on the health of the system. When journalists asked the military what the messages were, there was no immediate response.
Questions people ask
Do civilian phones and military receivers use the same satellites?
Yes. Civilian and military users share the same satellites and the same open signal for position and time, and the military adds an encrypted signal on top. The hidden text messages ride inside the open navigation data, where most civilian receivers simply skip them.
Why send encryption keys from satellites instead of the internet?
Because the keys cannot safely travel over the internet, where they could be intercepted. For years they were carried by hand and physically plugged into receivers, and since each key lasted only about a week, the work never ended. An over-the-air system lets satellites broadcast the next key, itself locked up in code, to all authorized users at once.
How could a simple repeating pattern trouble a GPS receiver?
Receivers expect data to follow strict formatting rules, so unexpected values can confuse software that was never built to handle them. The 101010 pattern breaks the allowed character rules for that message slot. There have been other cases where similar patterns caused GPS receivers to crash or malfunction.