Insurgent interception of US drone video feeds in Iraq (disclosed December 2009)
What happened
Shia militants in Iraq intercepted, recorded and shared live full-motion video from US MQ-1 Predator unmanned aircraft by capturing the unencrypted satellite downlink that carried it. The tool reported was SkyGrabber, a commercial Russian program sold for about 26 US dollars and designed to capture content from satellite internet transmissions; one of its developers, quoted in the Wall Street Journal disclosure, said it was built to download legal content such as music and video and was never intended to intercept military data. US personnel found the problem when they seized a militant's laptop containing captured drone video in late 2008, and in mid-2009 recovered extensive further recordings from other laptops. Military officials stated that the militants were not able to hack into the Predator system, disrupt the feeds, or take control of the vehicles, and the Pentagon began encrypting the downlink after the disclosure. The Wall Street Journal broke the story on 17 December 2009 and it was picked up the same day by the BBC, CNN, the Christian Science Monitor and others.
This record and the one slugged nato-balkans-uav-feed-interception-2002 are the same failure seven years apart: the 2002 record is a civilian's disclosure of an unencrypted ISR downlink over commercial satellite infrastructure, and this one is an adversary exploiting the same condition operationally. Read together they are the strongest pairing in this batch. They are deliberately not linked by canonical_event_id, which exists to deduplicate a single event rather than to relate two. The scale of the collection is characterised only qualitatively in the reporting, so nothing quantified is recorded.
Attack vector
Reception of an unencrypted satellite downlink carrying live ISR video, using an off-the-shelf consumer satellite-internet capture program. No transmission by the adversary and no compromise of the aircraft, its command link, or any ground system.
Operational impact
Loss of confidentiality of live and recorded full-motion surveillance video over Iraq for an unquantified period before December 2009. No loss of availability or of control: officials stated the feeds were not disrupted and the aircraft were not commandeered.
Data compromised
Live full-motion video from MQ-1 Predator unmanned aircraft operating over Iraq, collected, recorded and shared among militant groups.
Affected segments
link
Disclosed
2009-12-17
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Mission data, live full-motion ISR video, was taken off the satellite downlink by an adversary who then recorded, retained and shared it; recovered laptops held extensive archives of it. This is the textbook case of EXF-0003.02 and the sources describe it rather than leave it to inference. Unlike the 2002 NATO disclosure record, there is an exfiltrating actor here and the material was collected and kept.
The collection depended on commercial satellite reception: the video traversed commercial satellite services in clear, and the tool used was SkyGrabber, a consumer product built and sold for capturing satellite-internet traffic. The edge is derived because no source describes the militants procuring a ground station service; what is described is the class of commercial infrastructure the interception rode on.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
Receive-only. Nothing was transmitted, and military officials stated the feeds were not disrupted and the vehicles not controlled.
Arguable, and a reviewer may add it. Left off because the confidentiality loss is fully recorded by EXF-0003.02, and IMP-0006 is used in this batch for theft of capacity (FLTSATCOM, LTTE), which is a different thing.
The physical act matches, but the purpose here was obtaining mission data, which is exfiltration, not reconnaissance in service of a later action. Mapping both would record one act twice. REC-0005.02 is used in this batch where reception is the whole of the event (
nato-balkans-uav-feed-interception-2002,fltsatcom-brazil-transponder-hijacking-2009).
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: Same-day reporting by a public-service broadcaster, attributing the disclosure in its own headline. Retrieved 2026-08-20 at the stored URL, which returned HTTP 200; the facts in this record were read from same-day Christian Science Monitor coverage.
Tier 2: Same-day bylined reporting by an established newspaper, sourced to the Wall Street Journal disclosure and to military officials.
Tier 2: Same-day reporting by a major broadcaster, independent of the Christian Science Monitor.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.