Terrestrial networking trains a particular intuition. A packet travels a path, and the parties on that path are the ones who can see it. Your ISP is in a position to observe your traffic; a stranger in another city is not. Everything people know about network surveillance is built on assuming an adversary must be positioned somewhere on the route.
Radio does not work that way, and satellite radio works that way least of all.
The physics that create the problem
A geostationary satellite sits roughly 36,000 kilometres above the equator, matching the Earth's rotation so it appears fixed in the sky. That altitude is what makes it useful. A dish can be bolted to a wall and aimed once. It is also what creates the exposure, because a transmitter that far away cannot illuminate a small area. Beams cover regions measured in hundreds or thousands of kilometres.
Inside that footprint, the forward link, from the satellite down to customers, is a single multiplexed stream carrying traffic for everyone the beam serves. Consumer and enterprise satellite broadband has long been carried over the DVB-S and DVB-S2 standards, which were designed for television. A subscriber terminal locks onto the carrier, demodulates the stream, and keeps the packets addressed to it.
The phrase that matters is keeps the packets addressed to it. Discarding everyone else's traffic is what a well-behaved terminal does. It is not enforced by anything. A different receiver, pointed at the same satellite, can keep all of it.
The return link, from your terminal up to the satellite, is a narrow directional beam aimed at a point in space. Intercepting that requires being in the beam, which for practical purposes means being in orbit. So the exposure is one-directional: what is sent to you is broadly receivable, what you send is not. Anyone reasoning about this needs to keep the two links separate.
What was actually demonstrated
This is not a theoretical concern, and the strongest public result has a name and a date.
At Black Hat USA in 2020, James Pavur, then a doctoral researcher at Oxford, presented "Whispers Among the Stars." Using off-the-shelf home satellite television equipment costing a few hundred dollars, he collected traffic from a large set of geostationary satellites over an extended period. The captured data included sensitive material from maritime, aviation and industrial customers, unencrypted, sent by organisations who had every reason to assume a link that expensive was also private.
The result that made the work land was the total absence of sophistication required. No exploit, no proximity to any target, no compromise of any operator. A dish, a tuner card, and software that a hobbyist community had already written for other purposes.
Earlier work through the 2010s found similar things, and later research has repeated the exercise with better equipment and found more. This is a stable property of the medium rather than one company's mistake in one year.
Why the links are not simply encrypted
The obvious question is why operators do not encrypt the forward link end to end. There are real reasons, and none of them are good enough.
| Constraint | What it does to the incentive |
|---|---|
| Latency budget | A geostationary round trip is already around half a second. Operators optimise aggressively, including performance-enhancing proxies that terminate and rewrite TCP connections, and anything that gets in the way of those optimisations is resisted. |
| Legacy equipment | Terminals live in the field for a decade or more, on ships and remote sites where replacement is expensive. A link-layer change strands installed hardware. |
| Key management at scale | Encrypting a broadcast to many subscribers means distributing and rotating keys to terminals that may be offline for long periods, which is a genuinely hard operational problem. |
| The assumption of obscurity | For years the working belief was that satellite ground equipment was specialist and expensive. Consumer television hardware and software-defined radio removed that assumption, and the deployed base had already been built on it. |
There is a further wrinkle that undercuts the operators' own position. Those latency optimisations require the operator to see and modify the traffic, which means an operator-encrypted link would still be plaintext at the operator. Link encryption removes the passive stranger with the dish. It does not remove the operator.
What the new constellations change
Low Earth orbit systems are different in ways that matter, and the same in the way that matters most.
They orbit at a few hundred kilometres rather than 36,000, so beams are far narrower and cover a small area at any moment. The satellites move rapidly, so the mapping between a beam and a place on the ground changes constantly. Their user links are encrypted, and their signals are not a standard consumer television format that existing hardware happens to demodulate. Passive collection at scale is a materially harder problem against these systems than against a geostationary transponder.
What has not changed is the layer above. Encryption on the access link protects the segment between the terminal and the ground station and ends there. Beyond that, your traffic is on the public internet, visible to the operator's network and everything downstream, exactly as with any other ISP. A LEO provider is a satellite ISP, and the word carrying the weight in that phrase is the last one.
Link-layer encryption changes who can eavesdrop on the first hop. It has never been a statement about anything after that.
The correct fix, which has been available all along
Every result described above concerns traffic that was not encrypted by the endpoints. Pavur's captures were readable because the applications sending them used plaintext protocols, and the interesting question is what a passive listener gets when the endpoints do their job.
They get much less, and they still get something.
- Contents are protected by TLS 1.3 and by end-to-end encryption at the application layer. The passive receiver sees ciphertext.
- Destinations are often still visible. DNS queries, unless encrypted, name every site you visit. The TLS server name indication field has historically been plaintext, which is what Encrypted Client Hello exists to close, and its deployment is still partial.
- Traffic patterns remain. Timing, volume and the sizes of encrypted flows form a signature that traffic analysis works on. A broadcast medium hands the analyst a clean, complete capture of everyone in the footprint at once, which is a considerably better starting position than a tap on a single line.
- Your terminal is identifiable within the stream, so the traffic can be attributed to a subscriber even when its contents cannot be read.
A VPN is a reasonable measure here and a limited one. It collapses the visible destination to a single tunnel and hides DNS from the satellite link, which is a genuine improvement in this specific setting. It also moves the observation point to the VPN provider, and it does nothing about volume and timing.
When to care about this
Most people never touch a geostationary link. The population that does is specific: ships, aircraft, remote industrial sites, field operations in places without terrestrial infrastructure, and news organisations and aid workers working somewhere the local network is unavailable or untrustworthy. That last group is exactly the population for whom the answer to "is anyone listening" is not academic.
If you are in that group, the practical version is short. Treat the satellite link as a public medium, because it is one. Assume anything not encrypted by your own software before it leaves the device is readable by a stranger in the footprint, and assume that the fact of the connection, its timing and its volume are readable regardless.
That assumption is not specific to satellite. It is the same one that should govern hotel wifi, a shared office network, or a national backbone in a country that requires taps on it. Satellite makes it unusually vivid, because the eavesdropper does not need to be anywhere near you, but the design response is identical: put the encryption at the endpoints, where it does not depend on any property of the network in between.
That is the assumption Haven is built on. We encrypt on your device and decrypt on the recipient's, so the network in the middle can be hostile, broadcast, or both, and the guarantee does not change.