A new academic study has set off alarms across the telecom and security worlds. Large volumes of internet and phone traffic sent via geostationary (GEO) satellites are being broadcast without encryption, and can be passively intercepted using a few hundred dollars’ worth of consumer hardware. The research, led by teams at UC San Diego and the University of Maryland, documents exposed cellular backhaul, in-flight Wi-Fi metadata, industrial and utility communications, and even material tied to military and law-enforcement activity- all captured from a simple listening post on a San Diego rooftop. Press coverage and the researchers’ own site underscore how much of this data was in plain text, how little sophistication is required to receive it, and how many different industries were touched.
How the researchers listened: Legally, and at low cost
The team did not transmit anything or break into systems. They used a consumer satellite dish paired with an inexpensive tuner and custom software to receive downlink signals from GEO satellites visible over Southern California. Over a multi-year period, they scanned hundreds of transponders on dozens of satellites, rebuilt packet streams, and analyzed what real users and organizations were sending over those links. Their bill of materials- reported by both the paper and media write-ups- landed in the $600-$800 range, a sum that places this capability far below “nation-state only” territory. By design, receiving broadcast downlink signals is legal in many jurisdictions; the point of the study is how much sensitive information should never have been broadcast in the clear in the first place.
What turned up in the clear
The grab-bag was unsettling. On the telecom side, the researchers observed cellular backhaul data-traffic between a carrier’s core and remote cell towers. This contained unencrypted voice calls, text messages, internet sessions, device identifiers (like IMSIs), and even cellular encryption keys in some cases. Aviation links revealed in-flight Wi-Fi metadata and other aircraft network activity. Corporate and government networks surfaced internal emails and records, inventory and logistics traffic. ATM and point-of-sale networking details, and industrial-control/SCADA communications used by utilities and pipeline operators were also included. Press accounts describe data tied to high-profile brands and public entities. Several named companies stating they moved quickly to encrypt after being alerted.
Why so much was unencrypted
There isn’t a single “satellite switch” that turns encryption on for everyone. Protection can be applied at multiple layers: application (TLS/HTTPS), network (IPsec/VPN), and the satellite link itself. The problem, the researchers argue, is a culture of relying on obscurity and legacy practices. Especially on remote or bandwidth-constrained terminals. Some operators skip link-layer encryption due to licensing or hardware costs, accept configuration shortcuts that make troubleshooting simpler, or underestimate the risk that anyone outside a government lab could listen at scale. The result is a patchwork where a single misconfigured backhaul, aircraft link, or industrial endpoint can broadcast sensitive information across a continental footprint.
Scale matters: GEO’s giant footprints
GEO satellites sit 36,000 km above Earth and “see” huge swaths of the planet. A single downlink beam can cover parts of multiple countries. This means an exposed connection in one region may be audible far away to anyone pointing a dish at the right spot in the sky. The researchers emphasize they listened to only a fraction of satellites visible from one location-roughly a sliver of the global GEO belt. The true scope of exposure could be larger. That wide reach also explains why fixes matter: one corrected configuration can immediately remove sensitive data from the air for millions of square kilometers.
Industry responses so far
The team followed a coordinated disclosure process. Several organizations reportedly deployed encryption or other mitigations that the researchers later re-checked. Some telecoms framed the issue as limited to niche backhaul paths and stressed policies that require encryption when traffic leaves their closed networks; others did not respond on the record. Not every operator has acted yet, the researchers say, especially in corners of critical infrastructure where legacy equipment and operational risk make upgrades slow. The uneven reaction highlights an old lesson: when responsibility spans carriers, satcom providers, equipment vendors, and customer IT teams, gaps appear unless someone owns the end-to-end outcome.
What the study didn’t test
The research focused on geostationary links and did not analyze low-Earth-orbit (LEO) constellations such as Starlink. The authors note their understanding is that modern LEO systems use link and transport-layer encryption by default, but they did not independently verify that in this work. That matters because a growing share of satellite broadband is shifting to LEO. However, GEO remains deeply embedded in aviation, maritime, emergency services, oil and gas, remote retail, and developing-region telecom backhaul- precisely the domains where legacy configurations persist.
What organizations should do next
Treat satellite paths as untrusted networks. If your business touches aviation, maritime, remote retail, logistics, energy, mining, or government field ops, assume a satellite hop exists somewhere in your traffic, then verify. Concretely:
-
Inventory every terminal, modem, and managed satcom link your company pays for (directly or via a provider).
-
Enforce TLS for applications and require site-to-site VPN/IPsec for network segments that traverse satellite links.
-
Enable link-layer encryption offerings from your satcom provider where feasible; document the config and audit it periodically.
-
Monitor for unencrypted flows leaving your environment- especially signaling traffic, management interfaces, and any “temporary” backhaul shortcuts that became permanent during a past outage.
-
Update contracts and RFPs so vendors must attest to encryption at the app, network, and link layers, with testable evidence and incident response processes if that protection fails.
These steps are not exotic; they’re the same layered-defense measures you’d apply to public Wi-Fi or an ISP you don’t control. The difference is the blast radius when satellite links go wrong.
The study doesn’t claim the sky is falling. It shows, rigorously, that sensitive traffic still rides GEO satellites in the clear, and that the barrier to intercepting it is low. Because GEO beams cover vast areas, the consequences of a single misconfiguration can be continental.
