Captain Midnight hijacking of the HBO transponder on Galaxy 1 (27 April 1986)
What happened
Early on Sunday 27 April 1986, during HBO's broadcast of The Falcon and the Snowman, the HBO carrier on the Galaxy 1 satellite was overridden for about four and a half minutes and replaced with a five-line text card signed Captain Midnight, protesting HBO's subscription pricing and warning Showtime and The Movie Channel; viewers across the eastern half of the United States saw it. The intruder was John R. MacDougall, a satellite-dish dealer who also worked as an operations engineer at the Central Florida Teleport in Ocala, Florida, and who used that facility's 30-foot uplink dish and a character generator to produce and transmit the card. Contemporaneous reporting describes an escalating power contest in which HBO's technician raised the legitimate uplink power to reassert the carrier and MacDougall countered before ending the transmission. The FCC narrowed a field of licensed transmitters by antenna capability and by identifying the character generator model; a tip from a member of the public who overheard MacDougall discussing it closed the case. He pleaded guilty to operating a satellite uplink transmitter without a licence, was fined 5,000 US dollars and given one year of unsupervised probation. The event contributed directly to the Electronic Communications Privacy Act of 1986, which made interference with a satellite transmission a felony under 18 U.S.C. section 1367.
The founding case of the broadcast-transponder-hijack pattern and the reason the offence exists in US law in its current form, which is why it is worth holding despite involving no spacecraft compromise at all. The detailed technical reporting that circulates about this event (the transponder number, the uplink frequency, the specific power figures in the contest, and the character generator model) traces to contemporaneous magazine coverage that could not be retrieved in this session, so those figures are deliberately excluded from this description and from every technique rationale; only what the retrievable sources state is used.
Attack vector
Misuse of a licensed commercial satellite uplink facility by an employee with legitimate access, slewing its 30-foot dish onto the target satellite and transmitting an interfering carrier that displaced the legitimate programming feed.
Operational impact
About four and a half minutes of substituted content in place of HBO's programming across the eastern half of the United States. No source reports damage to the spacecraft or lasting loss of the transponder.
Affected segments
link, ground, user
Disclosed
1986-04-27
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
The reported mechanism is an interfering uplink carrier displacing the legitimate one, contested in power by the legitimate operator before the intruder prevailed and ended the transmission. That contest is uplink jamming in the literal sense, and it is what distinguishes this record from the 1987 Haynie case, where no power contest is described. Added here; SPARTA's bibliography does not cite this incident at EX-0016.01.
HBO's programming was replaced for about four and a half minutes across the eastern half of the United States. Loss of service to the intended audience is the whole of the reported effect and the basis of the prosecution.
MacDougall used the uplink facility of the Central Florida Teleport, his employer and a commercial teleport with no relationship to HBO, and the FBI and FCC traced the transmission back to that company. Staging a transmission through a third party's ground system is RD-0002.02, described rather than inferred.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
Founder ruling 2026-08-05, editorial question 3 (
docs/decisions.mdentry 73).EX-0012.06sits underEX-0012Modify On-Board Values. An interfering uplink displaced a legitimate carrier at a bent-pipe transponder and no source establishes that anything on board was modified. That is theSI-7stored-versus-transient boundary already codified inCLAUDE.md, applied to a technique rather than a control. SPARTA cites this incident atEX-0012.06; the citation is domain context, not evidence that payload data was modified on board.Notably, SPARTA does not cite this incident at IA-0008.01, though it cites Haynie there, and the distinction holds: the Central Florida Teleport was a licensed commercial uplink operating from its normal site with its normal equipment. The unauthorised element is the use, which RD-0002.02 already records. Mapping both would double-count one act.
The card was signed and announced itself as an intrusion. Nobody was misled about what they were looking at.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
- Cable's 'Captain Midnight' ApprehendedTrade press
Tier 2: Contemporaneous reporting by a major newspaper on the day after the guilty plea, from the court and FCC record. Retrieved 2026-08-20 through a browser carrying a session, after HTTP 403 and an edge Access Denied to anonymous methods; the apprehension and plea it reports are also attested by CBS News.
Tier 2: A major broadcaster republishing its own 1986 coverage with commentary. Retrospective rather than contemporaneous, but it reproduces the network's original reporting rather than summarising others.
Tier 3: A tertiary encyclopaedia article. Not authoritative in itself; its value here is as a retrievable index of the contemporaneous sources, each claim carrying an attribution to a named publication and date.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.