Starlink user-terminal RF jamming in Ukraine (2022)
What happened
In the weeks following Russia's February 2022 invasion of Ukraine, Russian electronic-warfare units jammed SpaceX Starlink user terminals operating in contested areas, producing service outages that Elon Musk described as lasting hours at a time. SpaceX responded with a software change pushed to the terminals. Dave Tremper, the US Department of Defense's director of electronic warfare, told reporters in April 2022 that the fix arrived the day after the jamming was publicly reported and that it rendered the jamming ineffective, calling the speed of the response eyewatering from an electronic-warfare technologist's perspective. Musk stated on 25 March 2022 that the constellation had resisted all hacking and jamming attempts. No source used here names the Russian systems, the band, the power, or the geographic extent, and no source describes what the SpaceX software change did.
The jamming itself is ordinary electronic warfare; what makes the episode citable is the response. A commercial operator changed its user-segment behaviour within about a day, and a serving US electronic-warfare official said on the record that the speed was beyond what his own enterprise could manage. Read the confidence rating as covering the mechanism rather than the event: that jamming occurred and that service was restored is well attested, but the only accounts of how it was defeated are Musk's claim about his own product and Tremper's second-hand admiration. Neither is an independent measurement of Starlink's jam resistance, and no source establishes whether the fix held: IEEE Spectrum, in May 2023, relays a leaked US Department of Defense conclusion that Russia was still trying to jam Starlink, and Ukrainian troops blaming Starlink problems on jamming, but frames the question conditionally and quotes an analyst saying little is publicly known. This record extends an existing database row; date_disclosed is corrected from the IEEE Spectrum publication date to the date of Musk's public statement.
Attack vector
Ground-based radio-frequency interference against the Ku-band downlink received by Starlink user terminals in contested areas of Ukraine.
Operational impact
Loss of Starlink service at affected terminals for periods reported as hours at a time, reversed by a SpaceX software change. No damage to terminals or spacecraft is reported.
Affected segments
link, user
Disclosed
2022-03-25
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
The parent is mapped alongside the child because the sources establish the general fact of RF jamming more firmly than they establish the link direction, and because EX-0016 carries the reversibility property the episode demonstrates: service returned once the jamming was defeated and nothing was damaged. Confidence is moderate because no source characterises the jamming beyond the fact of it. The evidence type is derived rather than direct for the same reason: with no source characterising the jamming beyond the fact of it, there is no on-point excerpt to read against this technique.
Every source describes RF interference denying service to user terminals on the ground. That is EX-0016.02's exact subject: a jammer operating within the receiving terminal antenna's field of view, matched to the downlink frequency, whose victims are the satellite's users rather than the satellite. The behaviour is described by the sources rather than derived from them.
The reported effect is temporary impairment of access to a service, reversed by a software change. That is IMP-0002's definition, measures designed to temporarily impair use or access for a period of time, and it is what the sources state rather than something inferred from them.
Musk's account is of terminals jammed for hours at a time, which is elimination of use for a period rather than impairment of it, and SPARTA distinguishes Denial from Disruption on precisely that line. The edge is derived because no source measures the outage or states that service was wholly unavailable rather than degraded.
RD-0005.04 covers an actor obtaining and fielding jamming or spoofing capability against space-system communications, and states that such effects are usually transient and hard to attribute quickly, which matches the episode. The sources establish that Russian electronic-warfare capability was present and used against Starlink links, but do not name the systems, so the capability-acquisition step is derived from the observed effect rather than described.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
This is a defense-evasion technique: jam the telemetry downlink so operators cannot see what the spacecraft is doing. No source suggests the jamming was intended to blind SpaceX to its own constellation.
Flooding is resource exhaustion; nothing in the sources describes traffic volume as the mechanism.
SPARTA's own bibliography cites this technique against one of the Starlink-jamming articles, and EX-0013.02's description does extend to RF-layer interference driving AGC and clock recovery. But EX-0016.02 is the specific technique for this behaviour and EX-0013.02 the general one; CLAUDE.md's rule is to prefer the specific. Mapping both would double-count one act.
No source describes interference at the spacecraft's receive antenna. The reported victim is the terminal on the ground. Mapping both directions because "jamming happened" is the padding this record avoids.
An initial-access technique: using a counterspace weapon to create conditions for execution against the target. The jamming here was the effect, not a step toward one.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: Named defence-trade reporting of on-the-record remarks by a serving US Department of Defense official. Authoritative on what Tremper said; dependent on SpaceX for the underlying facts.
Tier 2: Named reporting by an established engineering-press title, synthesising jamming observations made by others rather than any the author took. Independent of the operators and of the states involved, and at one remove from the events throughout, so it is secondary on every specific it carries. Authoritative on the general pattern it describes; the record it supports leans on it for context rather than for the incident's particulars.
- SpaceX shut down a Russian electromagnetic warfare attack in Ukraine last month — and the Pentagon is taking notesTrade presscorroborating
Tier 2: Named defence-trade reporting of the same event as the primary. Corroborates the quotation, not the underlying facts, which both outlets take from SpaceX.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.