You're assuming it requires specialized military gear, as opposed to consumer gear with a flashed firmware. I believe GPS L1 C/A subframe 4 is on the ordinary L1 C/A civil signal, which means commercial receivers can receive it. They just can't (ordinarily) decrypt it. But a few KB of extra code would change that. A pretty broad set of Android phones can receive this data, without even needing to reflash the GPS firmware: you can decrypt on the application processor, since this field is readable.

> You're assuming it requires specialized military gear, as opposed to consumer gear with a flashed firmware.

The author studied this supposition [code intended for mil gear] for some time and learned this.

    On 26 May 2011, all 31 active GPS satellites switched to the
    0xAA placeholder within just a few hours.
    This rapid daily change perfectly matches the operational
    rollout of the U.S. Over-the-Air Distribution (OTAD) network.

That doesn't really answer the question of whether it could be used to deliver "numbers station" type messages. Encrypted key material and enciphered messages should be indistinguishable. There are 18 bytes of high-entropy ciphertext that could be used for both purposes.

> That doesn't really answer the question of whether it could be used to deliver "numbers station" type messages.

This is true. I suggest that I didn't answer that question because my comment was only addressing the below assertion.

>> You're assuming it requires specialized military gear, as opposed to consumer gear with a flashed firmware.

As for the numbers station reference in the article, that phrasing seems silly. I think it distracts a bit from the article.

I think it's simply because of using a public channel for encrypted communication.

Thanks for all the replies: my phrasing was indeed bad I guess!

A "public channel" is a very broad definition, and most communication channels, including those used for encrypted communication, are by design more or less "public".

Situation with GPS that feels similar to "number stations" (which I only know about thanks to Boards of Canada's album "Geogaddi", tbh^^) is that encrypted messages are deliberatily broadcasted, not that the channel is in some way "public". The latter also applies to all encrypted internet traffic, I guess.

Technically all RF communications are "public." You have to use encryption if you want security.

Would point to point laser seem like it's RF and not readily snooped without detection?

Unless you are in a vacuum, a laser that can reach a useful distance can be observed due to atmospheric scattering.

true!

Yeah GPS is not the people's airwaves it is operated by the US Space Force, I suggest you read up on your history.

OK, I have to further narrow down my statement then: a publicly readable medium (or one-way channel).

I didn't want to imply that regular people could simply inject data into what's emitted by GPS satellites.

Sorry if that wasn't clear, but I am aware that GPS is operated by the US military.

I disagree? The point of a numbers station is that it broadcasts in the clear and anyone with a receiver can get it, but only people with the appropriate decryption key can make any use of it. Since it's broadcasting all the time, there's no need for steganography or covert transmission. That's exactly what a numbers station is.

Where the article loses me is the implication that this is somehow sinister or beyond the pale: it's just piggybacking on a global transmitter network that exists anyway, why not?

> Since it's broadcasting all the time, there's no need for steganography or covert transmission.

Well, you could look at it that way, or you could say that the fact that it's broadcasting all the time is the steganography. That constant transmission of nonsense that nobody wants is what makes it fail to be suspicious when you send a message that somebody does want.

This implication is purely in your head. The article and the scientist whose work it describes are just pointing out the identification of some data that's been transmitted across a public channel for years without anyne noticing.

It's been noticed for a long long time, as noted in the article, this is more or less the first time it has broken in more general public news media.

Civilian high precision surveying has been reverse engineering raw GPS since the Navstar sats and swapping notes on back channels.

If you need a key it's not "in the clear".

Its all comes down to what we buy as the definition for a number station. For me a number station needs sends a message to be a number station, not a key.

>For me a number station needs sends a message to be a number station, not a key.

We don't know that it's a key that's being sent. For all we know, it could be just random data. Obviously it's most likely not random data, but ciphertext. Either way, we have no idea what the message is.

It is kind of like a number station but it's meant for machine to machine communication of commands, keys, and probably test messages specifically for military GPS receivers. The US government has plenty of other satellites (and the internet) at its disposal for sending messages to people covertly. They don't need to risk screwing up critical infrastructure just to send a message to someone. It also wouldn't be prudent to give a secret agent something so obviously a piece of spycraft. There's plenty of off-the-shelf radio receivers you can buy worldwide that would be capable of picking up an encoded message transmitted by a passing satellite.

A data payload you didn't already know is a message. This message contains a key.