\ud83c\udf18Subscribe to 404 Media to get The Abstract, our newsletter about the most exciting and mind-boggling science news and studies of the week. The U.S. military has likely been quietly broadcasting codes for its global encryption network using public GPS for nearly 20 years, turning each satellite into a hidden \u201cnumbers station,\u201d according to Steven Murdoch, an information security expert, who detailed his findings in a new article in Inside GNSS.That means every device that uses GPS has been receiving hidden government information for years, and nobody outside the military knew it until now.\u00a0Murdoch, a professor of security engineering and head of the Information Security Research Group at University College London, presented evidence that a 176-bit GPS sequence labelled \u201cSubframe 4, Page 17\u201d is encrypted material from the Pentagon\u2019s Over-the-Air Distribution (OTAD) network, which delivers cryptographic keys to military personnel around the world.\u201cI think the evidence that it’s for key transmission\u2014for use in distributing the keys for accessing the military GPS signals\u2014is pretty strong now,\u201d Murdoch said in a call with 404 Media. He noted that the military has \u201cspecialized receivers that have the ability to have keys loaded into them\u201d and \u201cpresumably have the ability to decrypt these special messages.\u201dIn his new article, Murdoch described how this \u201cforgotten 176-bit slot in the world\u2019s most successful navigation signal turned out to be its quietest and most consequential broadcast.\u201dMurdoch first spotted the sequence more than a decade ago while he was a graduate student tasked with writing a decoder for raw GPS data while working on a project funded by the European Space Agency.\u201cI noticed that there was this random-looking data present in the subframe,\u201d he recalled. \u201cI looked at the specification, and thought that was a little bit unusual. I recorded a bunch of it to look for any obvious patterns, but that wasn’t the main role of the project, so we moved on.\u201dFrom the beginning, he suspected that the subframe field contained encrypted transmissions because the data was so random. \u201cRandom data is actually very unusual to get in nature,\u201d Murdoch said. \u201cIf you see it, either it’s been carefully designed to be random\u2014but then, why is someone sending out random data?\u2014or it’s encrypted data. I thought encrypted data is by far the most likely explanation.\u201dHe returned to the subframe on and off over the years, and solicited guesses about its content on Stack Exchange in 2023. Ahmed Kamruddin, a master\u2019s student at UCL, developed the project further in 2025. Then, this year, Murdoch put the last pieces of the puzzle together over several weeks by analyzing open archive Global Navigation Satellite System (GNSS) recordings collected since 2007 and kept by GFZ Helmholtz Centre for Geosciences.\u00a0\u00a0This dataset included more than 12 million observations of Subframe 4, Page 17, yielding 3,994 unique 176-bit messages. Within this corpus, Murdoch pinpointed key-repeating \u201csentinels\u201d including a pattern that appeared in February 2010 and was broadcast on and off across dozens of satellites for more than a decade.\u00a0Murdoch discovered that this particular sentinel was transmitted by all 31 operational satellites within a window of a few hours on May 26, 2011, potentially heralding the activation of a new operational system. He confirmed that this timeline coincided with the rollout of the military\u2019s Over-the-Air Distribution (OTAD) and the Over-the-Air Rekeying (OTAR) by cross-referencing declassified documents, including a 2015 presentation about the dates of the operation.\u00a0\u201cThere was a perfect match between the timeline and that presentation and the change points that were automatically identified from the data,\u201d Murdoch said. \u201cThat was the smoking gun that made me think: This is what it’s for.\u201dThese automated systems replaced the cumbersome manual distribution of cryptographic keying material, allowing military GPS receivers around the world to be rekeyed remotely through satellite broadcasts rather than through onsite procedures.For the next 11 years, this expansive rekeying operation was overlooked in public GPS data. In 2022, the system entered a new phase, according to Murdoch\u2019s analysis. The dominant sentinel pattern began to fade out and was replaced by new message formats, including broadcasts carrying a distinctive “TEXT” prefix that has gradually spread across the constellation.\u00a0Murdoch isn\u2019t sure what explains the recent transition, though it could be a possible modernization of the infrastructure or the introduction of a new protocol. But to him, the bigger takeaway is that the signals were always available for anyone willing to take a closer look, a discovery that suggests that there could be more revelations hidden for the cryptographically curious among us.\u201cEvery receiver in the world decodes Subframe 4, Page 17,\u201d Murdoch said in his new article. \u201cAlmost none of them have ever looked at it. The lesson generalizes: There is more to learn from the bytes already arriving at our antennas than from the bytes we wish were specified differently. The data are publicly available. The signal is overhead, twice a day, every day.\u201d\u00a0\u201cEvery GPS satellite is a numbers station,\u201d he concluded. \u201cThe receivers were always listening. We just had not been.\u201d\u00a0\u00a0\u00a0\ud83c\udf18Subscribe to 404 Media to get The Abstract, our newsletter about the most exciting and mind-boggling science news and studies of the week. <\/p>\n","protected":false},"excerpt":{"rendered":"