Skip to content
safemode.space
All incidents
2005-03-01 (approximate)
signal hijacking
link

LTTE unauthorised use of Intelsat 12 transponder capacity (shut down April 2007)

Confidence in this reading:
moderate

What happened

The Liberation Tigers of Tamil Eelam broadcast the National Television of Tamil Eelam and the Voice of Tigers radio service to audiences in Asia and Europe by uplinking from a location in LTTE-controlled northern Sri Lanka to the satellite formerly known as Europe Star 1, which became Intelsat 12 when Intelsat acquired PanAmSat in July 2006; the LTTE announced its use of the satellite in March 2005. Intelsat characterised the use as unauthorised, said it did not tolerate terrorists or others operating illegally on its satellites, and said it had been pursuing technical alternatives to halt the transmissions. Company officials met Sri Lanka's ambassador to the United States, Bernard Goonetilleke, and on 24 April 2007 Intelsat's general counsel Phillip Spector reported that the transponder had been switched off over the preceding weekend. Intelsat's account is that the unauthorised use had already been running for over a year when it acquired the spacecraft. No retrieved source describes how the capacity was obtained.

SPARTA's single citation for this incident is IMP-0002, Disruption, and this record rejects it: nothing in any retrieved source reports another user's service being interrupted, and the only service interruption in the record is Intelsat's own remediation. Unauthorised consumption of capacity is not disruption, and recording it as such would put this case on the same footing as the broadcast hijacks in this batch, where a legitimate carrier was actually displaced. This is the one record in the batch where the SPARTA-cited technique is rejected as the only cite for its incident, and it is flagged for a reviewer's decision. Overall confidence is moderate because the fact of unauthorised use and the fact of the shutdown are well attested while the access path is not attested at all.

Attack vector

Pirating of an empty transponder frequency on Intelsat 12 to carry the group's television and radio services, on Intelsat's own account. Its general counsel Phillip Spector described this as stealing the satellite's space and said no customer is authorised to sell its frequency to anybody else. None of the retrieved reporting describes the uplink equipment.

Operational impact

More than a year of unauthorised third-party use of commercial transponder capacity, ended by the operator switching the transponder off in April 2007. No source reports any other user's service being interrupted, degraded or denied.

Affected segments

link, space

Disclosed

2007-04-13

SPARTA techniques evidenced

Each row is a technique this record evidences, with the reasoning and the source that attests to it.

What relationship, confidence, and evidence mean on the rows below
Relationship

What kind of link this is between the technique and the target.

Mitigates: the target actively prevents, detects, or recovers from the technique.

Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.

Triggers obligation: the technique occurring is what triggers the duty the target imposes.

Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.

Confidence

How strongly the source supports this mapping, not how severe the technique is.

High: the source supports the mapping squarely.

Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.

Low: the source reaches the technique only in part.

Evidence

How close to the source text the mapping was made.

Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.

Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.

Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.

Considered and not mapped

These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.

  • No carrier contention is described. The LTTE occupied capacity; nothing suggests it displaced a competing carrier.

  • SPARTA's only cite for this incident. No retrieved source reports any other user's service being interrupted, degraded or denied. Unauthorised consumption of capacity is not disruption, and the only service interruption in the record is Intelsat's own remediation. Flagged for reviewer decision.

Sources

The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.

A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.

  • Daily News (Sri Lanka) · Walter Jayawardhana · 2007-04-13

    Tier 3: A Sri Lankan state-owned newspaper reporting on an adversary of the state it is owned by. Contemporaneous and close to the official sources, and an interested party on framing. Retrieved 2026-08-20 at the publisher's archive subdomain, which carries the same date path as the stored URL; the stored www host still returns 403. It reports Intelsat's assurance of 13 April and not the shutdown. No claim in this record rests on it alone; the shutdown, its confirmation by Intelsat's general counsel and the characterisation of the use as unauthorised are independently attested by the Via Satellite account carried at primary.

  • Via Satellite · 2007-04-30

    Tier 2: The satellite industry's trade publication of record, reporting the operator's own statements and its general counsel by name. Retrieved in full in this session. It reports the shutdown, confirmed on 24 April; the Daily News account this record also carries at primary reports Intelsat's assurance of 13 April. Two events eleven days apart, so neither account stands in place of the other.

  • Lanka Business Online

    Tier 3: A Sri Lankan business news outlet reporting the operator's statement. Contemporaneous, commercially rather than politically oriented, but still domestic to one side of the conflict.

Every source SafeMode Space reproduces, and on what terms: sources and attribution.

Corpus 2026.08.24-1, built 2026-08-24 from 226 techniques, 308 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.