Space Domain Awareness

Space surveillance, SSA/SDA, orbital debris expert. Retired USAF with 30+ years of space experience. Physics (M.S.) and Imaging Science (PhD). USAFA '92.

[Space Domain Awareness @shell_jim]

3/n This animated plot illustrates the evolution of the orbit plane of the debris field, with the color coded to the area/mass of the objects. Only objects with an accuracy < 1000 km at epoch are shown (677 as of 2025-02-24).

[Oleg Kutkov 🇺🇦 @olegkutkov]

Starlink, Starshield, GPS, and the Claims About “Hacking”: A Technical Explanation

A post accusing Ukraine of “hacking” #Starlink is spreading rapidly on this platform.
The technical claims in that post are incorrect. They seem based on a collection of rumors circulating on Telegram, including information from Russian channels.
Unfortunately, this post and others like it are receiving an enormous number of likes and reposts.

That's why I believe it's important to address these claims with clear technical explanations rather than allow misleading information to spread unchecked.
This is a fairly detailed post, but I think the distinction matters.

Some of the technical information below comes from my own research and detailed analysis of Starlink terminal firmware, particularly its GPS, PNT, and velocity-processing systems.

#⃣ 1. What are Starlink and Starshield?

People still frequently confuse the two.

Starlink is SpaceX's commercial satellite internet service, designed for consumers, businesses, and other commercial users.

Starlink supports operation in motion, but the permitted speed depends on the service plan, equipment, and geographic region.
Under commonly available commercial plans, the maximum authorized operating speed is 160 km/h (100 mph).
In Ukraine, Starlink terminals are subject to a specific speed restriction: they cannot operate at speeds above approximately 75–80 km/h.
This Ukraine-specific restriction was introduced less than a year ago, in coordination with Ukrainian authorities, to prevent Starlink terminals from being used on drones.

Starshield is SpaceX's government-focused product and service family, based on Starlink technology and developed for national security applications.
It includes secure communications, Earth observation, and hosted payload capabilities.

Some Starshield systems involve dedicated government spacecraft and infrastructure. However, Starshield communications services can also use the underlying Starlink satellite network.

This distinction is important: Starshield does not necessarily mean a completely separate physical satellite constellation or entirely different user terminal hardware.

SpaceX develops and operates the underlying Starlink infrastructure. The U.S. government procures Starshield capabilities through contracts, with ownership and operational control depending on the particular system and arrangement.

The division of authority between SpaceX and the U.S. government has become especially relevant following the October 2026 incident.

Unlike ordinary commercial Starlink service, Starshield configurations used for military operations in Ukraine have supported substantially higher operating speeds.

#⃣ 2. Is Starshield available in Ukraine?

Yes. Starshield is operational in Ukraine and is extensively used by the Ukrainian military.

Starshield service has been used in Ukraine since approximately mid-2023. Subsequent U.S. government contracts and public reporting also confirm its availability.
The United States has procured Starshield services specifically to support Ukrainian military operations.
An October 2026 U.S. Senate letter explicitly confirms that Ukraine receives Starshield services procured by the U.S. government.

Therefore, the idea that Ukraine is somehow obtaining Starshield capabilities by secretly modifying commercial terminals fundamentally misunderstands how these services are provided.

How does the Ukrainian military use these services?

The Ukrainian military uses both commercial Starlink and Starshield.

Commercial Starlink is widely used because of its availability, relatively low cost, and excellent performance. For stationary installations and many other applications, commercial service is entirely sufficient.

Starshield is used for specialized military applications, including drones and other platforms requiring reliable connectivity at higher operating speeds.

These are capabilities provided through the Starshield service itself, not necessarily through unauthorized modifications to commercial Starlink hardware.

Using Starshield for its intended and authorized military applications is not inherently a violation of its service terms.

#⃣ 3. Regarding the October 2026 incident

Beginning on October 13–14, Ukrainian military units encountered unexpected speed restrictions affecting Starshield connectivity.

Terminals that had previously operated at substantially higher speeds began losing connectivity at approximately 160 km/h, with some reports describing interruptions at even lower speeds.

These restrictions disrupted military operations, particularly those involving high-speed unmanned systems.
The consequences were serious. Ukrainian officials reported that the restrictions interfered with drone operations, including efforts to intercept russian attack drones.

The decision-making process remains disputed. Neither SpaceX nor the U.S. government initially accepted responsibility for imposing the restrictions. Subsequent reporting and statements from U.S. lawmakers raised questions about who authorized the changes and which organization had the ability to implement them.

As of October 24, Ukraine's Ministry of Defense has officially reported that Starlink/Starshield connectivity is once again stable at speeds exceeding 400 km/h.

#⃣ 4. Does Starshield require separate hardware?

Not necessarily.

This is one of the most important points in the entire discussion.

Starshield is a government-focused service and technology family. In the case of satellite communications provided to Ukraine, existing Starlink terminal hardware can be provisioned to use Starshield service.
In December 2024, Bloomberg reported that a Pentagon contract would provide Starshield access to an additional 2,500 Starlink terminals already deployed in Ukraine, on top of 500 terminals previously covered.
The contracts therefore provided service for a total of 3,000 terminals.

In practice, compatible commercial Starlink hardware can be reassigned to Starshield service through the appropriate authorization and provisioning process.
This requires approval. It is not something that a customer can simply enable through the ordinary Starlink application.

Are there specialized Starshield terminals?

Yes.
For example, there is a specialized variant of the Starlink Mini known internally as `mini1_rugged`.
Based on my hardware research, this model uses an improved GNSS receiver, the Teseo V, instead of the receiver found in the regular Mini.

However, despite having repaired and examined numerous terminals and maintaining contact with people working with this equipment, I have not encountered evidence of this specific variant being supplied to Ukraine.

The Starshield terminals I have encountered or received information about in Ukraine are based on regular Starlink hardware.

Some terminals arrive already configured for Starshield service. Others can be provisioned for it through the appropriate channels.

The key point is simple:
A regular Starlink terminal operating under an authorized Starshield service configuration is still a Starshield terminal from the service perspective. It does not need to be physically modified or “hacked” to obtain that service.

#⃣ 5. Why does a Starlink/Starshield terminal require GPS?

Three years ago, I published an article explaining why GPS is important for Starlink terminals and how to improve GPS reception on the hardware available at that time: https://t.co/Ucng1IRu79

Some of the technical details in that article are now outdated, but the fundamental principles remain relevant.

A Starlink terminal requires sufficiently accurate position and timing information for network synchronization, beamforming, and other aspects of normal operation.

Location information can also be used for geographic service authorization.

Invalid or spoofed GPS data may interfere with these processes. Depending on the magnitude of the error and the firmware's ability to detect it, the terminal may lose connectivity or become unable to operate normally.

Modern firmware also includes mechanisms to detect suspicious or inconsistent GPS information.

When GPS data is considered unreliable, the terminal may attempt to use an alternative source of positioning, navigation, and timing (PNT) information derived from Starlink's own satellite constellation.

However, this fallback mechanism is not guaranteed to work reliably under every operating condition.

This distinction helps explain why some hardware modifications focus on improving GPS reception or supplying more reliable positioning data, rather than bypassing Starlink's network authorization mechanisms.

#⃣ 6. What is Starlink PNT?

Starlink PNT is a positioning, navigation, and timing capability that derives information from signals transmitted by Starlink satellites.

By combining satellite measurements with known orbital information, a terminal can estimate its position and movement independently of a conventional GPS receiver.

Starlink firmware contains the necessary functionality to process these measurements and use them as an alternative positioning source.
Initially, this functionality was more of an experimental feature. It was interesting from an engineering perspective, but its accuracy and reliability were limited.

Over time, it has improved significantly.
Modern implementations can provide useful positioning information, including when a terminal is moving.

There are still measurement errors, uncertainties, and limitations, but Starlink-derived PNT can serve as an alternative when GPS is unavailable or unreliable.

Nevertheless, conventional GNSS remains an important and generally preferred source of positioning and timing information in current terminal designs. For now.

Can the terminal operate without GPS?
Under certain conditions, yes.
Starlink firmware provides a gRPC request called `dish_inhibit_gps`, which controls whether GPS is used as a position source.
When GPS use is inhibited, the firmware can attempt to rely on alternative positioning information.

A similar situation occurs when GPS data becomes unavailable because of hardware or communication problems.

However, disabling GPS does not guarantee that the alternative positioning solution will be sufficiently accurate or available.
It also does not automatically change the terminal's service permissions.

#⃣ 7. How does a Starlink terminal determine its moving speed?

The GPS receiver is a primary source of position and velocity information.
Proprietary NMEA messages, including `TMPV`, carry information the terminal's motion-processing logic uses.

The firmware does not necessarily trust these measurements without additional validation.

The firmware can filter GPS-derived velocity and compare it with information from other available sources, including Starlink-derived positioning.

The terminal also contains an inertial measurement unit (IMU), whose acceleration measurements can help evaluate movement and detect inconsistencies.

The firmware applies thresholds and consistency checks to these measurements.
These mechanisms run internally and aren't exposed as user-configurable settings.

If GPS measurements differ significantly from the expected values or fail validation, the firmware can reject them.

However, GPS validation and service-speed enforcement are two different things.

Rejecting GPS data does not automatically mean that the terminal has exceeded the permitted operating speed.
The terminal's service configuration determines whether operation at a particular speed is authorized.

When the relevant speed policy is violated, the terminal may report a condition such as: `MOVING_TOO_FAST_FOR_POLICY`

This distinction is essential when evaluating claims about GPS modification.

Simply changing GPS-reported velocity does not automatically change the terminal's authorized operating speed or eliminate the firmware's internal validation mechanisms.

As explained earlier, appropriately provisioned Starshield service supports high-speed operation without the same restrictions imposed on ordinary commercial configurations.

Therefore, no additional “hacking” is required to obtain high-speed capability when that capability is already authorized as part of the service.

Reliable GNSS reception remains desirable, however.
This is one reason specialized terminal designs may incorporate improved receivers, such as the Teseo V used in the `mini1_rugged` variant.
It also explains the existence of solutions intended to improve GPS reception or provide a more reliable PNT input.

**Improving positioning reliability is not the same thing as bypassing service authorization.**

#⃣ 8. How does Starlink geofencing work?

There are two important factors: geographic service authorization and physical RF coverage.

Understanding the difference is essential.

Geographic service authorization

Starlink uses geographic information to determine where service is available and whether a particular terminal is authorized to operate.

The system uses logical geographic regions rather than relying exclusively on the physical boundaries of satellite beams.

H3 is one geographic indexing system relevant to this discussion. It divides the Earth's surface into hierarchical hexagonal cells that represent geographic locations and regions.

Geographic indexing provides a convenient way to manage coverage and service policies, but an H3 cell should not be confused with a physical satellite beam.

Network authorization can depend on several factors, including geographic location, service configuration, terminal identity, and applicable restrictions.

A terminal may be physically capable of receiving a satellite signal while still being denied access to the service.

This is an important distinction when discussing restricted territories, including russia.

Receiving a Starlink signal does not necessarily mean the terminal is authorized to connect to the network.

Physical RF coverage

Satellite beams cannot perfectly follow national borders or the boundaries of geographic indexing cells.

An RF beam has a physical footprint determined by the satellite antenna, beam steering, operating conditions, and geometry.
Its boundaries are not perfectly sharp.
Consequently, a beam may illuminate areas on both sides of a national border even though the service is authorized on only one side.
This is a normal characteristic of satellite communications, not evidence that geographic service restrictions have been disabled.

The role of GPS in geofencing

The terminal's reported location provides another source of information for determining whether it is operating in an authorized region.

The network can use terminal positioning information, together with its own authorization rules, to determine whether service should be permitted.

When operation is prohibited, the terminal may receive an appropriate disablement code from the network.

These mechanisms should be understood as parts of a broader service authorization system, rather than as a single GPS check controlling everything.

Can geofencing be bypassed by supplying modified GPS coordinates?

This question requires some nuance.
Changing the location reported by a GPS receiver may influence positioning-dependent decisions, but it does not automatically override network authorization.
Starlink also has other information available to evaluate terminal operation, and its firmware includes mechanisms for detecting inconsistent positioning data.

Large discrepancies can disrupt normal positioning and beamforming calculations, trigger validation failures, or cause the terminal to lose connectivity.

Most importantly, changing GPS coordinates does not by itself grant a terminal permission to use a service or geographic region for which it is not authorized.

#⃣ 9. So what exactly is being called a “Starlink hack”?

This is where much of the confusion comes from.

The modifications being discussed online are primarily related to improving GPS reception or providing the terminal with reliable positioning and timing information.

These are technical solutions intended to improve connectivity and stability, particularly when the terminal is moving or operating in an environment with GPS interference.

They do not automatically bypass Starlink's speed restrictions, geographic limitations, or network authorization mechanisms.

As explained earlier, regular Starlink hardware can also operate under an officially authorized Starshield service configuration, which supports high-speed military applications.

Neither improving GPS reliability nor using an authorized Starshield service constitutes hacking Starlink.

It's important to understand these differences before making accusations based on photographs, rumors, or incomplete technical information.

#⃣ Conclusion

Starlink and Starshield use closely related technologies, but they are different services with different capabilities and restrictions.

Regular Starlink hardware can operate under an officially authorized Starshield service configuration. No special hardware modifications are required.
Improving GPS reception or providing reliable positioning data does not mean bypassing Starlink's network restrictions.

Using Starshield for authorized military operations is not hacking. Neither is improving a terminal's GPS reliability.

My goal is simply to explain how these systems work and clear up the confusion surrounding them.
Technical accusations should be based on evidence, not rumors.

#starlink #starshield #gps

[Space Domain Awareness @shell_jim]

@CRBinz Ha -- I lost all my elite frequent flyer status years ago...and am delighted by it :-)

[Space Domain Awareness @shell_jim]

Initial event analysis on Substack -> https://t.co/ZrFgk58swm

[Space Domain Awareness @shell_jim]

Update: Debris from active PRC satellite Yaogan 50-02.

@S4S_SDA has now cataloged 62 pieces of debris originating from the PRC's active Yaogan 50-02 satellite (68196 / 2026-051A) on around 20 July 2026 (ref my initial analysis on Substack, link in thread).

In spite of the numerous objects, Yaogan 50-02's satellite bus continues to have at least a partially operational attitude determination & control and propulsion subsystems as evidenced by the station-keeping maneuver observed subsequent to the event (ref Substack).

Thankfully, all objects have high area to mass and are rapidly bleeding off energy in spite of their higher altitudes. Reference the animated Gabbard below, where it's fascinating to observe perigee heights increasing (but movement to the left illustrates energy is being loss).
#SpaceDomainAwareness #SpaceSustainability #SpaceDebris

(Orbital data courtesy of @S4S_SDA via @SpaceTrackOrg and used with permission per ODR 24-002-4)

[Space Domain Awareness @shell_jim]

@CRBinz Yeah, like we need any more confusion….sigh

[Space Domain Awareness @shell_jim]

https://t.co/t3eg2TnJF6

[s2a systems @s2a_systems]

Optical observation conditions for this object are currently poor at our sites due to orbit/Earth's shadow. Nevertheless, a pass over Australia, recorded on 2026-10-08, still showed some debris around METEOR 2-7 #12456.

[Space Domain Awareness @shell_jim]

New space debris event with Soviet satellite launched in 1981

Yesterday @LeoLabs_Space provided public notification of a debris-generating event from the defunct Soviet Meteor-2-7 satellite launched in 1981 (US catalog 12456 / 1981-043A). As of this writing, there has not been a notification of the event from @S4S_SDA via @SpaceTrackOrg . LeoLabs has reported "tens of fragments" (ref their x post in comments).

This is actually the second such event from this satellite, with the first occurring in March of 2004. The Meteor-2 satellites were the 2nd generation of Soviet weather satellites. @planet4589 provides a mass estimate of ~ 1500 kg.

Using pre- and post-orbital position information (element sets), the time of the debris event is approximately 2026-10-05 09:45 +/- 10 min UTC.

Meteor 2-7's altitude of 855 km is in a dense region for orbital debris. Might we have experienced an impact from one of the numerous untracked debris objects? It is furthermore observed that the event time estimate places the 81 degree inclined satellite near its highest latitude position (ref graphic below), where the debris spatial density is highest. We will likely never know....

#SpaceDomainAwareness #SpaceTrafficManagement #LongTermSustainmentOfSpace

(Orbital data courtesy of U.S. Space Forces – Space (S4S) via https://t.co/m3OEycBT6w and used with permission per ODR 24-002-4)

[Space Domain Awareness @shell_jim]

@LeoLabs_Space X post

https://t.co/MK3XwNQxeU

[LeoLabs @LeoLabs_Space]

LeoLabs has detected another debris-generating event in orbit. This is the latest in a series of events we've seen over the last 6 months. Together, they point to a worrying trend for space safety and security, and underscore the critical need for persistent sensing.

[Space Domain Awareness @shell_jim]

Substack post with more details here -> https://t.co/ZrFgk58swm

[Space Domain Awareness @shell_jim]

China's active Yaogan-50 02 satellite experiences a debris event on around 20 July 2026, but appears to still be maneuver capable. 43 pieces of debris cataloged to date. Although high altitude, the debris appear to have a high area to mass and thus much shorter lifetimes than originally anticipated. Details in my substack post (link in thread)

[Space Domain Awareness @shell_jim]

@planet4589 Perhaps F is payload adapter and R/B yet to be cataloged?

[Jeff Foust @jeff_foust]

Isar Aerospace reports the second stage of Spectrum achieved a 180 x 500 km orbit (preliminary figures) on today's launch.

[Space Domain Awareness @shell_jim]

💥 🛰️ Debris event from USSF's "LDPE-1" GEO Satellite on 27 July 2026.

The Long Duration Propulsive ESPA-1 (LDPE-1) appears to have experienced a debris event on 27 July 2026 at 12:50 UTC (+/- 30 min). This is satellite 49818 in the @SpaceTrackOrg catalog (Int Des 2021-118B).

Two public sources of data corroborate the event:
1️⃣ orbital position information from @S4S_SDA via https://t.co/m3OEycBT6w (see graphic below) and
2️⃣ seven new objects appeared in the Vimpel catalog which associate back to LDPE-1 at a time concurrent with the orbit change--to within a ~ 1 hr window 2 sigma'ish

Thankfully LDPE-1 was operating in a supersynchronous orbit ~365 km above GEO altitude, or clear of the GEO Protected Region at the time of the event, and fully remains clear of the GEO Protected Region. The last noted meaningful maneuver was in April 2026, but predominant sources indicate the satellite was still active.

Unfortunately, some of the debris generated now encroaches into the GEO Protected Region.

LDPE-1 is a Northrop Grumman "ESPAStar" payload. There are several ESPAStar payloads active in GEO today with more missions planned. Hopefully the systemic root cause of the debris event is not something that could be repeated in the other platforms.

#SpaceDebris #LongTermSustainmentOfSpace #SpaceDomainAwareness #SpaceDomainNormsOfBehavior

Orbit data from @S4S_SDA via https://t.co/m3OEycBT6w, used with permission per ODR 24-002-4.

[Space Domain Awareness @shell_jim]

@s2a_systems yep (sigh) .... YASDE time....

[Space Domain Awareness @shell_jim]

On related matters, I was surprised to learn that China is not a signatory to the Hague Code of Conduct? In short, launch NOTAMs are optional for China is my short take. I'm interested in learning more about comparable bilateral/multilateral agreements China may have if others could weight in....

[Space Domain Awareness @shell_jim]

@RAH335 @mickeywzx @RAH335 at least the first orbital data courtesy of the US on @SpaceTrackOrg

[Space Domain Awareness @shell_jim]

Debris associated with Russian upper stage from Feb 2026 GEO launch cataloged.

On 12 Feb 2026, a Russian GEO launch placed Elektro-L No.5 (67756 / 2026-028A) and the first Iranian GEO satellite, "Jam-e Jam 1" (67757 / 2026-028B).

@mickeywzx caught the GEO insertion and subsequent Block DM-03 rocket body (67758 / 2026-028C) passivation with an amazing EO collect video, cropped portion below. (Original video here https://t.co/XJgugKhNe1)

The passivation appeared to result in numerous additional objects. It was unclear at the time if this was simply ice (frozen liquid oxygen effluent) from the depletion burn, or if persistent objects may actually be present.

In the video, Elektro-L No.5 and the Jam-e Jam 1 satellite are seen receding to the upper left relative to the upper stage (presumably the brighter object is Elektro-L No.5).

Well, it appears there were in fact some persistent objects. A piece of debris (100099 / 2026-028D) from the upper stage was cataloged by U.S. Space Forces – Space (S4S) on 20 July 2026. It is likely additional pieces accompanied this one, but they may not be held in track custody with sufficient fidelity to enter the catalog.
#SpaceDomainAwareness #SpaceDebris #LongTermSustainment

[Mickey @mickeywzx]

Correction!
By newly published TLE, these are Russian GSO mission on the same day, deployed weather sat Elektro-L No.5 with secondary payload Iran-DBS. The venting and debris are from Blok-DM-03 upper stage.

[Space Domain Awareness @shell_jim]

@Cosmic_Penguin @COMSPOC_OPS See https://t.co/DJ8VaiMA2b