The Quiet Numbers Station: Decoding nineteen years of GPS cryptography
Article excerpt
The Global Positioning System (GPS) relies on its primary L1 frequency to broadcast precise timing and orbital data, allowing receivers on Earth to calculate their exact location. Because the L1 C/A signal transmits at just fifty bits per second, every bit of this navigation data must earn its place. Yet, within this highly constrained signal, […]
The Global Positioning System (GPS) relies on its primary L1 frequency to broadcast precise timing and orbital data, allowing receivers on Earth to calculate their exact location. Because the L1 C/A signal transmits at just fifty bits per second, every bit of this navigation data must earn its place.
Yet, within this highly constrained signal, the standard sets aside Subframe 4, Page 17, a 176-bit field broadcast every 12.5 minutes, for “special messages with the specific contents at the discretion of the Operating Command”. While the official specification suggests it carries readable text, the reality is entirely different. For nearly twenty years, this channel has acted as a global numbers station, broadcasting military ciphertext on a public signal to billions of receivers in plain sight.
The Information Security researchers in University College London (UCL) analysed an archive of 12.16 million observations collected between 2007 and early 2026.
We have documented the full technical breakdown, including our methodology, in our article published in the May/June 2026 edition of Inside GNSS: The Empty Field That Wasn’t: GPS, OTAD and Two Decades of Encrypted Broadcasts. For security researchers, this dataset presents an extraordinary target. It is a globally deployed, operational cryptographic network sitting in plain sight, perfectly suited for traditional traffic analysis and structural cryptanalysis.
Read the detailed analysis in the post here.