Evading censorship from above

Assessing the feasibility of Starlink as a censorship circumvention tool

Hammas Bin Tanveer

Senior Information Controls Fellow @ CSE University of Michigan

Preface

Starlink is the largest low-earth orbit satellite constellation which currently provides internet to over 70 countries. Recently, Starlink has been in the news for providing internet to politically sensitive areas like Ukraine and Iran. In this recommendation piece, we conduct a feasibility analysis on Starlink as a country-wide censorship circumvention tool and provide suggestions to improve its availability in politically sensitive countries.

What is Starlink?

Starlink is a Low-Earth Orbit (LEO) satellite constellation. LEO constellations consist of a group of satellites which orbit the earth between 80 and 2000 km. The distance at which the satellites orbit in LEO constellations is much less when compared to satellites in other type of constellations e.g. Geostationary Orbit satellite constellations (GEO). Satellites in GEO constellations orbit the earth at ~36,000km making the period of their orbit the same as the earth’s. This allows the satellites in this constellation to serve a very large area on earth and consistently stay the same point on earth. The figure below shows the scale of the distances of these constellations.

The large distance of satellites in the GEO satellites results in a very high latency in internet connections rendering the connection useless for some applications. This is where LEO satellites come into play. As they are much closer to earth, they provide significantly lower latencies.

However, as these satellites are this close to earth, they orbit at rates much faster than earth’s, which only allows them to serve a single location on earth for only a few minutes at a time. Hence, to cover the same ground on earth that a GEO satellite covers, a much larger number of LEO satellites are required. The Starlink constellation currently consists of more than 4000 satellites.

How does Starlink work?

Starlink has 3 separate components that work together to provide internet to its customers:

The User terminal (UT): is a piece of hardware that is responsible for keeping track of satellites, establishing connections with them and relaying user data to the satellite constellation. It contains phased-array antennas which keep track of the fast moving satellites overhead.

The Satellite constellation: consists of ~4000 low-earth orbit satellites that receive user’s traffic from the user terminal and relays it forward to the ground stations. Each satellite in the constellation contains 4 phased-array antennas and 2 parabolic antennas. The constellation currently serves customers in 32 different countries

The Ground station: consists of a set of phased-array antennas that send and receive user’s requests and responses from the satellite and passes it on to one of Starlink’s points-of-presence (POP). There are currently 147 Starlink ground stations deployed around the world.

When a Starlink customer accesses the internet, all of their traffic is transmitted to one of the satellites in the Starlink constellation through the UT. The UT can only connect to 1 satellite at a time which is in its Field-of-View (FOV). The FOV for a UT is a part of the sky where it can establish a connection with a satellite. The FOV is defined in terms of the Azimuth and the Angle of Elevation of satellites with respect to the UT.

Azimuth: the angle between North, measured clockwise around the observer’s horizon, and the satellite. It determines the direction of the celestial body e.g. North is 0, East is 90 etc.

Angle of Elevation (AOE): the angle between a vertical plane passing through the user terminal and a diagonal connecting the UT and the satellite. Angle of Elevation at the horizon is 0 and at a point right above the UT is 90 (Zenith).

The FOV for Starlink’s terminal is for all values of Azimuths and for all values of AOE above 25 degrees. From all the satellites available in a UT’s FOV, Starlink’s global network scheduler decides which satellite to assign to a given UT. Once assigned, the UT starts forwarding the user’s traffic to the assigned satellite. For the sake of this blog, the satellite acts effectively as a reflector. It bounces all traffic that it receives from the UT down to a ground station.

💡 Note: For a satellite to be able to relay UTs traffic to a ground station, it has to be in the FOV of both the UT and the ground station simultaneously (barring satellites with inter-satellite link capability).

Once the ground station receives the user’s traffic, it forwards it to one of Starlink’s points-of- presence (POP). Starlink’s POP essentially works in the same way as a content delivery network’s POP; increasing Starlink’s network’s footprint on the internet. The POP forwards this traffic to the internet backbone, over cable, from where it reaches the desired server. All replies to the user’s requests take the same path back to the UT. This path is demonstrated in the figure above.

Starlink and recent political unrest

The recent war between Russia and Ukraine led to the destruction of most of Ukraine’s internet cables and communication systems [1]. In response, the Ukraine government publicly requesting

Starlink for UTs in an attempt to recover ground communications [2]. As Starlink does not use the conventional internet structure to provide internet connectivity, this could serve as an alternative which would work without any major overhauls. This request was met and Starlink became an indispensable part of the communications infrastructure in Ukraine for the duration of the war; used by both the civilians and the military [8].

Recently, political unrest broke out in Iran after a 22 year old woman, Mahsa Amini, died in police custody for not following the country’s dress code [3]. To control the country wide political unrest, the Iranian government imposed a blanket internet censorship regime on the whole country [4]. As the internet was a very indispensable part of the protests, used for both communication and dissemination of information to other parts of the world, people started looking for alternatives. With Starlink’s recent success in Ukraine, people in Iran turned to Starlink for help . Although Starlink agreed to provide access to Iranians [9] , the conditions differed a lot when compared to those of Ukraine.

As described above, there are 3 pieces of hardware which are essential in making Starlink work in a region; satellites, UTs and ground stations. Although satellites from the Starlink constellation were present above both Iran and Ukraine, there were no ground stations or UTs. Getting Starlink into Ukraine was an effort led by the Ukrainian government, which allowed Starlink to ship ~25,000 UTs into the country [10]. However, in Iran, getting Starlink UTs inside the country was not as easy. The Iranian government internet shutdown blocked access to the internet through all channel including circumvention tools like VPN and Tor. As part of the crackdown effort, the Iranian government also declared Starlink as illegal [11]. As Starlink could provide a way around the internet shutdown, a group of Iranian activists started a “smuggling” campaign to get Starlink UTs into the country [12].

How does Starlink circumvent censorship?

Censorship in censor states e.g. China, Russia and Iran is implemented at the border routers, of either the country or the individual ISPs, inside the country. Hence, censor states can monitor all traffic entering and leaving the country, and consequently censor traffic that is deemed sensitive. This allows censor states to have significant control over the traditional, terrestrial internet for which all of traffic flows through cables and routers.

However, an internet connection over Starlink takes a path which involves an aerial and a terrestrial path. As long as the terrestrial component of the path falls outside the censor state’s borders, internet connections over Starlink cannot be censored using the current techniques.

The figure above visualizes how Starlink connections are able to circumvent traditional forms of internet censorship. The terrestrial component of an internet connection over Starlink only starts after the satellite relays traffic it receives from the UT, to the ground station. However, if the ground station is present outside the censored region’s border, the network tap cannot monitor this traffic and subsequently block it. As there are no Starlink ground stations currently operating inside Iran, user traffic from UTs in the country is relayed to ground stations outside of it. As described above, this allows Starlink users inside Iran to evade traditional censorship techniques.

Inter-Satellite Links The angle of elevation constraints described above mandate that the user terminal has to be within a set distance of a ground station to be able to relay user traffic. However, there are currently noground stations around Iran which satisfy this distance requirement. This forces user traffic from UTs inside Iran to be relayed to ground stations farther away than this maximum distance constraint using inter-satellite links.

As shown in the figure above, inter-satellite links allow user traffic to be relayed from one satellite to another in the constellation. User traffic is relayed until it reaches a satellite which is inside one of Starlink’s ground station’s field-of-view, which then forwards this traffic to the ground station — traffic is relayed back to the UT via the same path. Inter-satellite links are only available on satellites which are version 1.5 and above.

Availability of Starlink satellites over Iran As described above, users in Iran will have to rely on satellites which are capable of inter-satellite links to get internet connectivity through Starlink. We now look at the availability of Starlink satellites — version 1.5 and over — in 3 major cities in Iran. Satellite positions are publicly available and published in two-line element set (TLE) format by NORAD. TLEs contain certain orbital elements of satellites which can be used to identify satellite positions at different points in time using a propagation algorithm. We use the SGP4 propagation algorithm implemented by the Skyfield library [12] to identify Starlink satellites (v1.5 and above) that were above 3 major cities in Iran throughout a day. We then count the number of unique satellites available every 15 seconds — this is in line with how Starlink schedules its satellites to UTs (as mentioned in Starlink’s FCC filings [13]). These counts are shown in the figure below for 3 major cities — Mashhad, Shiraz and Iran — for two, 2 hour slots below.

Availability of Starlink satellites can vary by cities and time of day. Averaged over the 3 locations and all 15 second slots, there are ~15 satellites available. The plot shows that Shiraz has less availability of satellites (13) when compared to other 2 cities (16 on average). We also observe that number of satellites available are more, after noon (16) when compared to early morning (13). The variations in the number of available satellites suggest that the performance of the internet connection provided by Starlink can vary by location and time of day.

Capacity analysis of internet provided by Starlink in Iran

In the section above, we established that there is a substantial presence of Starlink satellites over the major cities in Iran. Using these available satellites, we now want to understand the expected performance of the internet provided by Starlink in Iran to assess how widely Starlink can be used as a tool in Iran to circumvent censorship. To achieve this, we use capacity simulation provided by starlink.sx to analyze internet performance over a 3-hour period for the 3 major cities mentioned above.

Starlink provides internet to UTs on a per-cell basis. Each Starlink cell is a hexagon inscribed in a circle — which is, by some estimates, 15 miles in diameter [23]. To simulate Starlink capacity on a per-cell basis, we use a set of satellite and constellation related characteristics which are either best- case approximations or explicitly mentioned in Starlink’s FCC filings and patent applications. Specifically, we use the following characteristics:

AOE of satellites picked: The algorithm which decides the satellite allocations to the UTs is largely unknown. For the purpose of this simulation, we prefer satellites with the lowest possible AOEs. This allows the satellites to project their beam (concentrated satellite signal) over a larger surface area.

Beam spread: Our simulation allows satellites to spread their beam over 10 cells, allowing them to serve UTs in a larger geographic area. Each Starlink satellite is capable of projecting 48 beams.

Beam capacity: We set each satellite beam’s capacity to 500Mbps; this is reasonably close to the theoretical maximum (700Mbps).

Full capacity on inter-satellite links: For the purpose of this simulation, we allow satellites using inter-satellite links to use 100% of the gateway capacity they are connected to. However, in reality, all satellites connected by the inter-satellite link “chain” would be connected to the same gateway and hence would be using only a portion of the available gateway capacity.

There are other characteristics which we also take into account for this simulation — for more information, visit the very in-depth and informative blog by Mike Puchol. The characteristics mentioned above demonstrate that we consider a more ideal than expected case in simulating Starlink’s capacity over Iran.

💡 Note: Starlink.sx models a country’s capacity independently i.e. satellites servicing cells in Iran will be able to provide 100% of their capacity. In reality, the capacity is shared by cells in neighboring counties.

The figure below shows the capacity simulation in Iran for a snapshot in time. The colors show the relative capacities each cell receives; red → less relative capacity, green → more relative capacity. The plot only shows capacities for cells with a population > 1000 people.

To approximate the internet capacity that the current Starlink constellation can provide to the major cities in Iran, we aggregate the individual capacities provided to each cell within a major city’s geographic radius. For each of these cells, we measure the simulated capacity every 15 seconds for 3 hours. To get an estimate of the amount of people Starlink can optimistically serve, we use the simulated capacity to calculate the number of UTs that can operate at 12Mbps in the 3 major cities — which is the median internet download speed of fixed-broadband internet in Iran [24].

The box plot shows the number of UTs that can operate in the 3 major cities at the country’s median internet download speeds.

On average, the 3 cities can potentially have ~40 UTs operating at 12Mbps. These 3 cities have an average population of 4.8 million people.

The boxplot shows that this number drops to near 0 for certain times in Shiraz and Mashhad meaning that service outages can be expected even with optimistic capacity simulations.

There is high variability within each city during the 3 hour period; the number of UTs serving 12Mbps can vary between 0 and 200.

The capacity simulations show that despite the availability of satellites over Iran, the internet service provided by Starlink over Iran is expected to be spotty and inconsistent even with optimistic simulation parameters. We also observe that despite the very high population in urban areas, Starlink can only provide service to a small fraction — on average only 40 UTs can operate at 12Mbps in each major city. Therefore, Starlink’s current constellation’s coverage over Iran cannot provide a widespread and consistent solution to nationwide internet censorship in the country.

Censoring Starlink

Although internet access through Starlink cannot be blocked through traditional censorship techniques, censor states like Iran resort to other methods to block access to Starlink.

1. Restricting access to hardware: Pieces of hardware such as UTs are indispensable to the functioning of Starlink. Censor states such as Iran and Russia have declared the possession and usage of Starlink UTs as illegal [11,15]. This has severely restricted the flow of UTs into Iran — there are currently only ~800 UTs operating in the country [16]. As the router connected to a UT can, at max, serve 128 devices at once, the number of people that Starlink can currently serve in Iran at the moment remains severely restricted.
2. Signal interference and detection: Censor states like Russia have previously attacked geo- stationary orbit satellite based communication causing widespread outages in a multitude of countries [17]. Although similar attacks on low-earth orbit satellites (e.g. Starlink) are much harder at the time, researchers in censor states like China are urging the government to ramp up their efforts in developing “a combination of soft and hard kill methods” to undermine Starlink’s functionality [20]. Furthermore, the radio-waves emitted from Starlink UTs can be used to triangulate the UT’s location [18]. This information can be used to destroy the UT and prosecute people found using it [19].
3. Attacking the Starlink network: Recent studies have shown that Starlink’s network and hardware can be targets of denial of service attacks. Giuliari et al. found that public knowledge of satellite and ground station locations, predictable and constrained routing and global accessibility make LEO networks e.g. Starlink particularly vulnerable to denial of service attacks from a distributed adversary [21]. Smailes et al. developed a fuzzing technique that revealed a “kill switch” for Starlink’s UT [22] which can be used to essentially turn a UT off for a period of time. Censor states like Iran can use similar techniques to block internet access through Starlink.

Possible measures to improve Starlink’s availability in Iran

The capacity analysis above shows that given the current state of the Starlink constellation and ground network, Starlink cannot be a widespread solution to state-backed censorship in Iran. The number of Starlink dishes that can function in the region is very limited and the internet provided by the constellation is inconsistent in terms of bandwidth. In this section, we will discuss potential solutions that can make Starlink a more feasible solution.

1. The current Starlink constellation is still not in its final form; it currently consists of less than half of the planned 12,000 satellites [25]. As the constellation size grows, the availability of satellites will increase globally providing higher bandwidths in countries which are currently under-served.
2. Due to the unavailability of ground stations inside Iran, version-1 satellites — which are on average 35% of all available satellites over Iran — cannot serve any of the Starlink dishes operating inside the country as they are not equipped with inter-satellite links. As Starlink is being used as a censorship circumvention tool in Iran, getting regulatory approval for installing ground stations inside the country might not be possible. However, installing ground stations near Iran’s border in countries like Turkey, Kuwait, Pakistan etc. can enable version-1 satellites over Iran to use them. This can allow a larger fraction of satellites over Iran to be utilized providing higher bandwidths to a larger amount of Starlink dishes.
3. Satellites that serve Starlink dishes in Iran are currently being served by ground stations in other regions of the world through inter-satellite links. These ground stations are, most likely, already being used by satellites in their vicinity, leaving only a percentage of the limited bandwidth available for satellites over Iran. To counter this, Starlink can potentially install “censorship-only” ground stations in countries where ground stations are already present. As Starlink has already cleared regulatory approvals in these countries, setting up new ground stations should potentially be less complicated. Furthermore, satellites over censored countries like Iran would be able to use the complete available bandwidth of ground-stations allowing them to serve more people affected by censorship.

References

1. Starlink: Why the internet from Elon Musk is crucial for Ukraine (no date) Visit Ukraine — RULES OF SAVE VISIT TO UKRAINE. Available at: https://visitukraine.today/blog/1046/starlink-why-the-internet-from-elon-musk-is-crucial- for-ukraine (Accessed: November 18, 2022).
2. Wall, Mike. “What’s Going on with Elon Musk, SpaceX’s Starlink and Ukraine? Here’s What We Know.” Space.com, Space, 19 Oct. 2022, https://www.space.com/spacex-starlink- elon-musk-ukraine-explainer.
3. https://www.cnn.com/2022/10/26/middleeast/iran-clashes-mahsa-amini-grave-intl
4. “Iran Shuts down Internet as Death Toll from Mahsa Amini ‘Bad Hijab’ Protests Rises.” Middle East Eye, https://www.middleeasteye.net/news/iran-mahsa-amini-protests-internet- shut-down.
5. Biddle, Sam. “No, Elon Musk’s Starlink Probably Won’t Fix Iranian Internet Censorship.” The Intercept, The Intercept, 27 Sept. 2022, https://theintercept.com/2022/09/27/elon-musk-iran-protest-starlink-internet/.
6. Press, Andre M. Chang/Zuma. “Iranian Protesters Struggle to Activate Elon Musk’s Starlink and Circumvent Internet Restrictions.” The Wall Street Journal, Dow Jones & Company, 6 Oct. 2022, https://www.wsj.com/articles/iranian-protesters-struggle-to- activate-starlink-and-circumvent-internet-restrictions-11664798819.
7. Woollacott, Emma. “Starlink Terminals Smuggled into Iran — but How Effective Can They Be?” Forbes, Forbes Magazine, 26 Oct. 2022,https://www.forbes.com/sites/emmawoollacott/2022/10/25/starlink-terminals- smuggled-into-iranbut-how-effective-can-they-be/?sh=28af54151027.
8. https://www.washingtonpost.com/national-security/2023/04/18/discord-leaks-starlink-ukraine/
9. https://thehill.com/policy/technology/3659726-musk-activating-starlink-satellite-internet-in- iran-after-biden-administration-relaxes-sanctions/
10. https://www.space.com/ukraine-spacex-starlink-terminals-offline-funding-shortfall
11. https://www.independent.co.uk/tech/starlink-iran-protests-internet-elon-musk-b2251872.html
12. Rhodes, Brandon. “Skyfield: High precision research-grade positions for planets and Earth satellites generator.” Astrophysics Source Code Library (2019): ascl-1907.
13. [n. d.]. Starlink Services LLC Application for ETC Designation | PDF Host. https://pdfhost.io/v/BnYWSR~wq_Starlink_Services_LLC_Application_for_ETC_Designation. ([n. d.])
14. https://starlink.sx/
15. https://arstechnica.com/science/2021/01/russia-may-fine-citizens-who-use-spacexs-starlink- internet-service/
16. https://www.iranintl.com/en/202301010925
17. https://cybernews.com/cyber-war/russia-confirmed-to-be-behind-cyberattacks-on-satellite- comms-wind-farms-in-europe/
18. https://edition.cnn.com/2022/03/03/tech/spacex-starlink-ukraine-internet-security-risks- scn/index.html
19. https://www.eff.org/deeplinks/2012/02/satphones-syria-and-surveillance
20. https://www.bloomberg.com/news/newsletters/2022-06-22/chinese-military-analyst-floats-idea- to-hack-musk-s-starlink
21. Giuliari, Giacomo, et al. “{ICARUS}: Attacking low earth orbit satellite networks.” 2021 USENIX Annual Technical Conference (USENIX ATC 21). 2021.
22. Smailes, Joshua, et al. “Dishing out DoS: How to Disable and Secure the Starlink User Terminal.” arXiv preprint arXiv:2303.00582 (2023).
23. http://www.satmagazine.com/story.php?number=1026762698#:~:text=The diameter of the cell,area of 379 square kilometers.
24. https://wisevoter.com/country-rankings/internet-speed-by-country/#iran
25. https://nssdc.gsfc.nasa.gov/nmc/spacecraft/display.action?id=2019-074D#:~:text=Later sub- constellations are planned,size to nearly 12000 satellites.