Inside GNSS Media & Research • May/June 2026 • 62

Inside GNSS Media & Research May/June 2026: 62

SUBFRAME 4 The Empty Field That Wasn’t: GPS, OTAD and Two Decades of Encrypted Broadcasts What 12 million GPS special messages reveal about military rekeying on a public channel. STEVEN J. MURDOCH UNIVERSITY COLLEGE LONDON successful navigation signal turned out to be its quietest and most consequen-tial broadcast—and how a few weeks of analysis on a laptop, applied to 19 years of public archive data, was enough to read its operational history off the bytes. data bits in Word 10. The final six bits of every word carry the parity bits. After parity stripping and reassembly, the 22 bytes of payload are decoded under a subset of Code Page 437. C old War shortwave numbers stations broadcast strings of digits to anonymous listeners, content that’s meaningless to anyone without a matching one-time pad. They still operate today. As it turns out, GPS broadcasts in much the same way. Buried in every L1 C/A navigation mes-sage is Subframe 4, Page 17—a 176-bit field that IS-GPS-200 reserves for “special messages with the specific contents at the discretion of the Operating Command.” Every satellite broadcasts it. Every receiver decodes the subframe that contains it. And for nearly two decades, no one has publicly explained what it contains. We analyzed 12.16 million observa-tions in this field from 2007 through early 2026. The content is not text. It is encrypted material consistent with the military’s Over-the-Air Distribution (OTAD) global rekeying network. For 19 years, every operational GPS satellite has been a numbers station—broadcast-ing ciphertext on a public channel, to billions of receivers, in plain sight. If you build receivers, write firmware, run signal monitoring, or care about the gap between civil and military signal transparency, this is your field too. You just have not been reading it. What follows is the story of how a forgotten 176-bit slot in the world’s most 176 Bits, Eight Words, One Forgotten Page The L1 C/A signal carries 50 bits per second. Every bit must earn its place. The Legacy Navigation message orga-nizes those bits into 1,500-bit frames, each frame into five 300-bit subframes, each subframe into ten 30-bit words. Subframes 1 to 3 carry the heavy work— clock corrections, ephemeris, the data your receiver needs every few seconds. Subframes 4 and 5 multiplex 25 rotat-ing pages. A receiver sees Page 17 of Subframe 4 every 12.5 minutes. Across 32 satellites, that is roughly 3,700 special-message payloads per day, fleet-wide. Multiplied across 19 years and the global ground-station archive, the figure climbs to 12.16 mil-lion observations. 176 bits is barely enough for a few floating-point numbers, but in a 50 bps signal, it is roughly 12% of every Subframe 4 broadcast. For the control segment to use that bandwidth con-sistently for two decades implies the content matters—even if no civilian receiver has ever rendered it. Figure 1 shows how the bits are ar-ranged. The 176-bit payload is frag-mented across Words 3 to 10 of Subframe 4, Page 17: 16 data bits in Word 3 (after eight bits of Data ID and SV ID = 55, the marker that identifies Page 17), 24 data bits in each of Words 4 to 9, and 16 MAY/JUNE 2026 Mining 19 Years of Navbits The corpus comes from the GFZ Potsdam open archive GNSS record-ings collected from a wide network of ground stations, dating back to 2007. After extraction, the numbers settle: 12.16 million observations of Subframe 4, Page 17, drawn from every operational PRN, spanning 19 years, yielding 3,994 unique 176-bit messages. Initial Python implementations needed hours to process a single year. To make iterative analysis practical, we wrote a Julia pipeline: NetCDF source files are converted to Apache Arrow, then thread-parallel bit extraction is performed into a DuckDB database. The full 19-year corpus extracts in seconds on a laptop. SQL across the lot returns in milliseconds. With 12.16 million payloads in a que-ryable database, the question becomes: What does this field actually contain? It Is Not Text. It Never Was. The first thing a researcher tries in an unknown field is the obvious one: maybe it is text in a different encod-ing. We computed the frequency of each of the 45 alphabet symbols defined by IS-GPS-200 across all 12.16 million observations. In English, frequencies have a fingerprint—E and T are com-mon, J and Z are rare, spaces and full stops are more common than digits. In a www.insidegnss.com 62<br>Issue List<br>May/June 2026

March/April 2026

January/February 2026

November/December 2025

September/October 2025

July/August 2025

May/June 2025

March/April 2025

January/February 2025

November/December 2024

September/October 2024

July/August 2024

May/June 2024

March/April 2024

January / February 2024

November/December 2023

September/October 2023

July/August 2023

May/June 2023

March/April 2023

January/February 2023

November/December...