Unencrypted NATO and US Balkans surveillance video receivable from a commercial satellite (disclosed June 2002)
What happened
In November 2001 John Locker, a British satellite enthusiast and freelance journalist writing for satellite-communications magazines, found that live video from US and NATO surveillance aircraft and drones operating over the Balkans was being relayed unencrypted through a commercial Telstar satellite and could be received on ordinary domestic satellite equipment. The footage showed military operations in Macedonia, Bosnia and Kosovo, including troops, armoured personnel carriers and helicopters; Locker described the imagery as good enough to pinpoint a location to within about six feet and as arriving within roughly three seconds of real time. He spent about seven months contacting British, NATO and US military officials before going public, and BBC Newsnight broadcast the story on 12 June 2002. Richard Perle, then chairman of the Pentagon's Defense Policy Board, said plans were under way to encrypt the data, and a US European Command spokesman said raw video of that kind does not amount to intelligence. Locker was explicit that he had transmitted nothing and that the material was free to air.
A disclosure, not an operation. No adversary was involved, nothing was transmitted by the discoverer, and no mission lost anything it was still using; two of SPARTA's four citing techniques are rejected on exactly that ground. The record is worth holding because the exposed condition, unencrypted ISR downlink carried over commercial space infrastructure, is the same condition an adversary exploited seven years later in the record slugged predator-drone-video-feed-interception-iraq-2009. The two should be read together. The satellite is named only as Telstar, positioned over Brazil; the specific spacecraft is not pinned down by any source retrieved here.
Attack vector
None. Live tactical surveillance video was transmitted in clear over a commercial communications satellite, so a lawfully operated receive-only domestic installation fell inside its distribution footprint.
Operational impact
Loss of confidentiality of live surveillance video over the Balkans for an unquantified period before June 2002. No source reports loss of availability, degradation, or any effect on the missions themselves.
Data compromised
Live and near-real-time full-motion video from US and NATO surveillance aircraft and drones operating over Macedonia, Bosnia and Kosovo.
Affected segments
link
Disclosed
2002-06-12
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Live tactical surveillance video reached an unintended recipient by way of the satellite downlink, which is the outcome EXF-0003.02 describes. The edge is derived and held at moderate because there was no exfiltrating actor: the data was transmitted in clear and free to air, and the recipient received rather than took it. A reviewer who holds that exfiltration requires an adversary should reject this edge and keep only REC-0005.02.
The whole of the reported event is reception of a satellite downlink by a party the transmission was not intended for, using ordinary domestic receiving equipment. That is REC-0005.02's subject, described by the sources rather than inferred from an effect.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
Locker transmitted nothing. A receive-only domestic dish is not a ground station in IA-0008.01's sense, which is an unauthorised station used to communicate with a spacecraft. He said so himself on the record: "This is not an intercept. I am not a hacker -- this is free to air programming." Accepting this edge would assert an uplink that never happened.
Nothing was taken from the mission. The video continued to reach its intended users throughout, and the material was transmitted unencrypted and free to air. The loss is one of confidentiality, which the two accepted edges already record; calling it theft would overstate what the sources support and would put a disclosure on the same footing as the 2009 Iraq interception, where an adversary collected and retained the same class of data.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
- Enthusiast watches Nato spy picturesTrade press
Tier 2: The originating report, by a public-service broadcaster's flagship current-affairs programme, based on its own work with the named discoverer. Retrieved 2026-08-20 through a browser, after a redirect a command-line client could not follow; the facts in this record were read from same-week CBS News coverage.
Tier 2: Contemporaneous reporting by a major broadcaster carrying its own on-the-record responses from US officials, not merely a summary of the BBC item.
Tier 2: Reporting by a major international broadcaster, published 13 June 2002, independent of CBS's account of the same disclosure.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.