A new academic study reveals that geosynchronous satellites are broadcasting unencrypted data globally, exposing private messages, encryption keys, and even military system traffic to anyone with basic equipment.
A team of six cybersecurity researchers from the University of Maryland and the University of California has uncovered a major global privacy risk — satellites are leaking sensitive information in plain text, accessible with as little as $600 worth of hardware.
In their study, researchers set up a consumer-grade satellite dish atop a university building in San Diego and monitored 39 geosynchronous satellites. The team discovered a “shockingly large amount of unencrypted traffic,” including cellular encryption keys, private SMS messages, and military or infrastructure communications.
“This data can be passively observed by anyone with a few hundred dollars of consumer-grade hardware,” the researchers stated, warning that data from a single transponder can cover nearly 40% of Earth’s surface.
This is amazing research by Nadia Heninger and her co-authors Wenyi Morty Zhang, Annie Dai, Keegan Ryan, Dave Levin and Aaron Schulman. TL;DR a huge number of satellite links over our heads are totally unencrypted. https://t.co/tXb4RTQS6L
— Matthew Green is on BlueSky (@matthew_d_green) October 14, 2025
How Serious Is the Threat?
The exposed data includes transmissions from telecommunication networks, logistics systems, and industrial infrastructure, revealing how easily satellite networks can be exploited. The team emphasized that most of these signals are transmitted without encryption, making them even more vulnerable than public WiFi networks in coffee shops.
Cybersecurity analyst Dr. Michael Trent commented, “This isn’t a sophisticated state-level hack — it’s a broadcast anyone can tune into. The implications for privacy and national security are enormous.”
Providers Respond, but Gaps Remain
The researchers said they notified several major satellite providers about the issue. Some companies, including networks used by T-Mobile, Walmart, and KPU, have since deployed encryption fixes. However, many systems remain unprotected as disclosure efforts continue.
“There is no single stakeholder responsible for encrypting GEO satellite communications,” the team explained, noting the fragmented responsibility across providers.
A key obstacle is cost. Encrypting satellite traffic can increase hardware expenses and reduce network efficiency — especially in remote or emergency networks. Some operators also underestimate the ease of interception, assuming satellites are inherently secure.
Some genuinely weird corporate security speak here. These downlinks are broadcasting your WiFi data across the entire northern hemisphere. It is not equivalent to a coffee shop! pic.twitter.com/rWxv5K5foD
— Matthew Green is on BlueSky (@matthew_d_green) October 14, 2025
Experts recommend using VPNs and end-to-end encrypted apps like Signal or Telegram when relying on satellite internet or messaging systems.
“Encryption should be used at every layer as defense-in-depth protection against individual failures. Treat encryption as mandatory, not an add-on,” the researchers advised.
While the study focused on geosynchronous satellites (GEO), the team noted that low-Earth orbit systems like Starlink appear to use encryption, though they have not yet been independently verified.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.
We use cookies to personalize content and ads, provide social media features, and analyze our traffic. In accordance with GDPR/AVG and EU cookie regulations, data is processed only with your consent. We may share information about your use of our website with our social media, advertising, and analytics partners, and you can manage or withdraw your consent at any time. View more
Cookies settings
Accept
Privacy & Cookie policy
Privacy & Cookies policy
Cookies list
Cookie name
Active
Privacy Policy
At BitxJournal.com, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, process, store, and protect personal information in accordance with the General Data Protection Regulation (GDPR) and AVG (EU privacy legislation).
1. Data Controller
BitxJournal.com acts as the data controller for all personal data processed through this website.
2. Personal Data We Collect
We may collect and process the following categories of data:
Personal Data
Name and email address (when you subscribe to newsletters or contact us)
Technical & Usage Data
IP address, browser type, operating system
Device information
Pages visited, referral sources, and interaction data
This data is collected via cookies, log files, and analytics technologies.
3. Legal Basis for Processing
We process personal data only when a lawful basis exists, including:
Consent – when you explicitly agree (e.g., cookies, newsletter sign-up)
Legitimate interest – to operate, secure, and improve our website
Legal obligation – when required by applicable laws
You may withdraw your consent at any time.
4. Purpose of Data Processing
Your data is processed for the following purposes:
Operating and maintaining the website
Improving content, usability, and performance
Sending newsletters or updates (only with consent)
Analyzing traffic and user behavior
Responding to inquiries or support requests
5. Cookies & Consent Management
We use cookies and similar technologies in compliance with EU Cookie Law.
Non-essential cookies are placed only after explicit user consent
Users may accept, reject, or manage cookie preferences at any time
Consent can be withdrawn without affecting prior lawful processing
Detailed cookie information is available in our Cookie Settings panel.
6. Third-Party Data Processing
We may share limited data with trusted third-party service providers, including:
Analytics providers (e.g., Google Analytics)
Advertising partners (for personalized or non-personalized ads)
These third parties act as data processors and process data only under contractual obligations compliant with GDPR/AVG.
7. International Data Transfers
Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent legal mechanisms.
8. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law.
9. Data Security
We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.
10. Your GDPR Rights
Under GDPR/AVG, you have the right to:
Access your personal data
Rectify inaccurate or incomplete data
Request data erasure (“right to be forgotten”)
Restrict or object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with a supervisory authority
11. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy at any time. Any changes will be posted on this page with a revised effective date.
12. Contact Information
For privacy-related inquiries or GDPR requests, contact:
