SpaceX Kills Obscure Starlink Location Feature

In a publication made yesterday, SpaceX announced the discontinuing of a little-known GPS capability that allows users to track and identify the location of a Starlink dish, a tool that most Starlink customers have probably never used. 

The company started informing clients on Tuesday about the end of gRPC, an open-source software framework that was included in Starlink hardware. “Dish location will no longer be available via the local device gRPC API as of May 20,” SpaceX stated in the email. 

The business described it as an update to Starlink’s “Location Data Access,” although it did not explain why. However, ordinary users don’t have to be concerned. The Starlink Mobile app’s “Subscription” section still allows you to view the location of your dish.

Your position is also not being disclosed by the GPS data on the gRPC API. The user must manually activate it, which was previously achievable by going to the Debug Data area.

Rather, according to software engineer Paul Sutherland, the move is anticipated to impact third-party software and Starlink resellers, especially when it comes to handling fleets of Starlink dishes used on the road or at sea.

Nexus Telemetry is a desktop Starlink monitoring application developed by Sutherland. He told members of the press that a customer may view a Starlink dish’s current location via the gRPC API, which is “very, very accurate.” Third-party solutions have found it useful to manage many Starlink dishes, including those on boats or RVs, and to view their GPS coordinates using the same API.

However, Sutherland pointed out in a blog post that there was a security trade-off associated with the locating function. “Any device on your network, including guest devices, could silently read your precise GPS coordinates if you’d enabled it,” he said. Your precise home location being accessible to any device on your LAN without permission is a privacy concern in and of itself. Furthermore, by simply querying the dish over HTTP rather than requesting location services from the OS, any application with network access may completely avoid the location permission prompts.

For this reason, Sutherland believes SpaceX may be tightening regulations to stop the service from endangering business or even military clients, such as those in Ukraine. He told PCMag, “If [hackers] breach a network using Starlink, they would be able to locate that [dish] device. ” They would be able to determine its location if they were broadcasting from a covert location. 

“That’s a serious concern in a conflict zone or any other situation when physical location is critical. From that angle, eliminating unauthorized access to location data makes sense,” he continued. That being said, I believe the main motivator is the general privacy and security concern rather than any particular military use case because the change affects all Starlink users worldwide, not just those in sensitive locations.

The limitation also results in “reduced troubleshooting accuracy, more reactive operations, and diminished ability to automate and enforce SLAs (Service Level Agreements) at an individual site level,” according to one Starlink reseller. SpaceX continues to provide enterprise clients with a “Telemetry API,” although it restricts position data to approximate grid cells rather than precise coordinates.

Jianping Pan, a computer science professor at the University of Victoria in Canada who specializes in satellite internet systems, stated, “Such a move just brings unnecessary issues for many users who are using gRPC for legitimate reasons.”

A request for comment was not immediately answered by SpaceX. However, the corporation may reinstate location access via the API despite the impending ban, though it will be secured by authentication. Additionally, some users have conjectured that the restriction would prevent malicious actors from installing Starlink on drones. However, Sutherland stated: “I would say the drone angle is unlikely since drone operators already have onboard GPS, and the local API is only accessible from devices on the dish’s own network.”

The impact of this removal of SpaceX’s precise Starlink location function forces developers of third-party tools like Nexus Telemetry to find workarounds such as external USB GPS receivers, while resellers and fleet managers face reduced troubleshooting accuracy and a diminished ability to enforce service level agreements at specific sites; although SpaceX still offers a Telemetry API for enterprise customers, it currently limits location data to approximate grid cells rather than exact coordinates, and while the company has not officially commented on the move, speculation suggests the feature may return in the future behind a secure authentication layer.