“Don’t Look Up”

The research team — Aaron Schulman, Nadia Heninger, and Keegan Ryan at UC San Diego, Dave Levin at the University of Maryland, with graduate students Wenyi “Morty” Zhang and Annie Dai — spent three years developing their methodology before conducting a systematic scan from a single satellite dish mounted on the roof of UCSD’s Computer Science building in La Jolla, California.

Equipment Used

From this single vantage point, the team scanned 39 geostationary satellites across 25 orbital longitudes, locking onto 411 Ku-band transponders and capturing 3.7 terabytes of raw data over a seven-month period beginning in August 2024. This covered only 14.3% of the world’s 273 Ku-band GEO satellites — meaning the actual scale of exposed data globally is vastly larger than what they observed.

The technical innovation lay not just in the scanning but in the parsing. Prior tools like GSExtract could extract IP packets from only 52 transponders (15% of the dataset). The researchers’ custom Python-based parser handled seven distinct protocol stack paths, five of them never previously documented, recovering packets from 238 captures (69%), totaling 192,624 packets — a 600% improvement over existing tools.

The scope of exposed sensitive data spans telecommunications, military operations, critical infrastructure, finance, retail, and aviation across multiple countries.

Cellular Backhaul: Reading Your Phone Calls From Space

In remote areas where cell towers cannot connect to the core network via fiber or microwave, carriers use satellite links — and these links were broadcasting subscriber data in the clear.

T-Mobile’s traffic included an IPsec layer, but it was configured with a NULL cipher — the cryptographic equivalent of an unlocked door labeled “security.”

Military and Government Communications

Mexican military satellite links exposed real-time asset tracking and telemetry data for Mi-17 and UH-60 Black Hawk helicopters, naval vessels, and armored vehicles, along with LIDAR/RADAR equipment status, maintenance logs, and deployment information including locations, mission roles, and regional assignments. Mexican law enforcement traffic revealed narcotics trafficking intelligence, incident reports, case tracking, evidence documentation, and surveillance data from remote command centers.

U.S. military sea vessels transmitted both encrypted and unencrypted traffic, with the unencrypted portion including DNS queries, SIP signaling (from which ship names could be identified), SNMP network management data, and ICMP packets.

Critical Infrastructure Exposure

Mexico’s Comisión Federal de Electricidad (CFE), serving nearly 50 million customers, transmitted customer service work orders with names, addresses, account numbers, and tariff types, plus communications about equipment failures and safety hazards at substations.

In the United States, unnamed critical infrastructure operators transmitted industrial control system (SCADA) data over unencrypted satellite links, including power grid repair tickets and oil and gas pipeline control traffic. Some infrastructure owners told the researchers they were concerned that a malicious actor could not only surveil but potentially disable or spoof control systems.

Corporate and Financial Data

The watchdog the satellite industry never hired.

The “Don’t Look Up” study is not the first warning about unencrypted satellite broadcasts — it is the loudest in a two-decade chorus that industry has systematically ignored.

“It’s crazy. The fact that this much data is going over satellites that anyone can pick up with an antenna is just incredible. I would be shocked if this is something that intelligence agencies of any size are not already exploiting.”— Matt Green, Johns Hopkins University

Matt Blaze, computer scientist and cryptographer at Georgetown University, underscored the accessibility: “This was not NSA-level resources. This was DirecTV-user-level resources. The barrier to entry for this type of attack is remarkably low.” He warned that within weeks of publication, hundreds or thousands of people would replicate the work — many without disclosing their findings.

“The threat model that everybody had in mind was that we need to be encrypting everything, because there are governments that are tapping undersea fiber optic cables. And now what we’re seeing is, this same kind of data is just being broadcast to a large fraction of the planet.”— Nadia Heninger, UC San Diego

A RAND Corporation report titled “SIGINT for Anyone” had already identified this trend, noting that capabilities “that used to be available only to nation-state peer adversaries are now available to any adversary who wants to use them.” The report specifically cited Iraqi insurgents who eavesdropped on unencrypted Predator drone video feeds transmitted via commercial satellites.

“There is no single stakeholder responsible for encrypting GEO satellite communications.”— Don’t Look Up, ACM CCS 2025

This fragmented responsibility — distributed across satellite operators, ground equipment providers, ISPs, and end customers, each assuming someone else handles encryption — mirrors a regulatory landscape that is strikingly vacant.

The comparison to SS7 — the signaling protocol underlying global telephony since the 1980s — is instructive. Known to be deeply insecure since at least 2014, exploited for banking fraud, location tracking, and even the pursuit of Sheikha Latifa of Dubai, no mandatory encryption requirements have ever been imposed. The satellite sector follows this same pattern of regulatory paralysis in the face of known, documented, and exploited vulnerabilities.

Encryption can be applied at multiple layers: link-layer (DVB-CSA or BISS scrambling), network-layer (IPsec), or application-layer (TLS/QUIC). Each has trade-offs in the satellite environment.

Link-layer encryption is available in most modern satellite modems but is typically an optional, separately licensed feature that operators must pay to enable — creating a perverse economic incentive against security.

IPsec adds 20–30 bytes of overhead per packet, and GEO satellite links’ 600ms round-trip latency degrades VPN and IPsec performance substantially. Panasonic Avionics stated that enabling encryption imposes a 20–30% loss in transponder bandwidth capacity.

Legacy systems present the most stubborn challenge. GEO satellites have 15–30 year operational lifespans, and many currently operating were designed before modern cryptographic standards existed. They function as “dumb bent-pipes” with no onboard processing capability. Ground terminals in remote locations often run off-grid on solar power, where cryptographic processing can exceed available energy budgets. Historical U.S. export controls led to encryption being developed as an optional add-on, with some documentation still referencing 56-bit key strengths — broken decades ago.

The researchers began responsible disclosure in December 2024 and conducted follow-up scans in February 2025 to verify remediation. The responses varied dramatically.

The “Don’t Look Up” study arrives at an inflection point for satellite communications security. The researchers’ release of their open-source tool on GitHub — which accumulated 439 stars and 73 forks by early 2026 — effectively ends the era of security through obscurity for satellite communications. Kaspersky compared the study’s potential impact to the 2015 Jeep hack, which “completely upended cybersecurity standards in the automotive industry.”

The broader satellite security landscape is evolving rapidly but unevenly. GPS spoofing incidents reached 1,500 flights per day by August 2024. The Viasat attack demonstrated that satellite systems are viable military targets. Over 84% of active satellites now operate in LEO, where newer systems tend to encrypt by default, but many SmallSats and CubeSats still lack adequate security controls.

The question is whether the industry and its regulators will respond with the urgency the exposure demands, or whether this will become another entry in the long catalog of infrastructure vulnerabilities — like SS7, like unencrypted DNS, like default passwords on industrial control systems — that persist for decades after disclosure because no single entity bears responsibility and no regulation compels action.

“VSAT systems should be treated as unencrypted wireless networks.”— NSA Advisory, May 2022

The “Don’t Look Up” researchers proved, with $800 and a rooftop, just how literally true that warning was.