Explaining how modern conflict works through OSINT. Founder @IGRecon | Writing at Global Recon

Joined August 2014
Iran’s blacklisted tankers are resurfacing with new names and claims of a Nicaraguan flag. But they’re still broadcasting the numbers that give them away. I traced a shared pattern in their new identities. Who’s supplying them?
1
2
4
844
John Hendricks retweeted
Replying to @MarioNawfal
I am a fan of people believing whatever they choose to. Live your life however you want to, but be cautious where you get your information. As someone who spent nearly 17 years in this community, nearly everything said in this clip is incorrect, and the discussion is occurring between 2 individuals with exactly zero seconds of combined experience in the community of which they are discussing.
18
22
589
10,305
John Hendricks retweeted
Starlink, Starshield, GPS, and the Claims About “Hacking”: A Technical Explanation A post accusing Ukraine of “hacking” #Starlink is spreading rapidly on this platform. The technical claims in that post are incorrect. They seem based on a collection of rumors circulating on Telegram, including information from Russian channels. Unfortunately, this post and others like it are receiving an enormous number of likes and reposts. That's why I believe it's important to address these claims with clear technical explanations rather than allow misleading information to spread unchecked. This is a fairly detailed post, but I think the distinction matters. Some of the technical information below comes from my own research and detailed analysis of Starlink terminal firmware, particularly its GPS, PNT, and velocity-processing systems. #⃣ 1. What are Starlink and Starshield? People still frequently confuse the two. Starlink is SpaceX's commercial satellite internet service, designed for consumers, businesses, and other commercial users. Starlink supports operation in motion, but the permitted speed depends on the service plan, equipment, and geographic region. Under commonly available commercial plans, the maximum authorized operating speed is 160 km/h (100 mph). In Ukraine, Starlink terminals are subject to a specific speed restriction: they cannot operate at speeds above approximately 75–80 km/h. This Ukraine-specific restriction was introduced less than a year ago, in coordination with Ukrainian authorities, to prevent Starlink terminals from being used on drones. Starshield is SpaceX's government-focused product and service family, based on Starlink technology and developed for national security applications. It includes secure communications, Earth observation, and hosted payload capabilities. Some Starshield systems involve dedicated government spacecraft and infrastructure. However, Starshield communications services can also use the underlying Starlink satellite network. This distinction is important: Starshield does not necessarily mean a completely separate physical satellite constellation or entirely different user terminal hardware. SpaceX develops and operates the underlying Starlink infrastructure. The U.S. government procures Starshield capabilities through contracts, with ownership and operational control depending on the particular system and arrangement. The division of authority between SpaceX and the U.S. government has become especially relevant following the October 2026 incident. Unlike ordinary commercial Starlink service, Starshield configurations used for military operations in Ukraine have supported substantially higher operating speeds. #⃣ 2. Is Starshield available in Ukraine? Yes. Starshield is operational in Ukraine and is extensively used by the Ukrainian military. Starshield service has been used in Ukraine since approximately mid-2023. Subsequent U.S. government contracts and public reporting also confirm its availability. The United States has procured Starshield services specifically to support Ukrainian military operations. An October 2026 U.S. Senate letter explicitly confirms that Ukraine receives Starshield services procured by the U.S. government. Therefore, the idea that Ukraine is somehow obtaining Starshield capabilities by secretly modifying commercial terminals fundamentally misunderstands how these services are provided. How does the Ukrainian military use these services? The Ukrainian military uses both commercial Starlink and Starshield. Commercial Starlink is widely used because of its availability, relatively low cost, and excellent performance. For stationary installations and many other applications, commercial service is entirely sufficient. Starshield is used for specialized military applications, including drones and other platforms requiring reliable connectivity at higher operating speeds. These are capabilities provided through the Starshield service itself, not necessarily through unauthorized modifications to commercial Starlink hardware. Using Starshield for its intended and authorized military applications is not inherently a violation of its service terms. #⃣ 3. Regarding the October 2026 incident Beginning on October 13–14, Ukrainian military units encountered unexpected speed restrictions affecting Starshield connectivity. Terminals that had previously operated at substantially higher speeds began losing connectivity at approximately 160 km/h, with some reports describing interruptions at even lower speeds. These restrictions disrupted military operations, particularly those involving high-speed unmanned systems. The consequences were serious. Ukrainian officials reported that the restrictions interfered with drone operations, including efforts to intercept russian attack drones. The decision-making process remains disputed. Neither SpaceX nor the U.S. government initially accepted responsibility for imposing the restrictions. Subsequent reporting and statements from U.S. lawmakers raised questions about who authorized the changes and which organization had the ability to implement them. As of October 24, Ukraine's Ministry of Defense has officially reported that Starlink/Starshield connectivity is once again stable at speeds exceeding 400 km/h. #⃣ 4. Does Starshield require separate hardware? Not necessarily. This is one of the most important points in the entire discussion. Starshield is a government-focused service and technology family. In the case of satellite communications provided to Ukraine, existing Starlink terminal hardware can be provisioned to use Starshield service. In December 2024, Bloomberg reported that a Pentagon contract would provide Starshield access to an additional 2,500 Starlink terminals already deployed in Ukraine, on top of 500 terminals previously covered. The contracts therefore provided service for a total of 3,000 terminals. In practice, compatible commercial Starlink hardware can be reassigned to Starshield service through the appropriate authorization and provisioning process. This requires approval. It is not something that a customer can simply enable through the ordinary Starlink application. Are there specialized Starshield terminals? Yes. For example, there is a specialized variant of the Starlink Mini known internally as `mini1_rugged`. Based on my hardware research, this model uses an improved GNSS receiver, the Teseo V, instead of the receiver found in the regular Mini. However, despite having repaired and examined numerous terminals and maintaining contact with people working with this equipment, I have not encountered evidence of this specific variant being supplied to Ukraine. The Starshield terminals I have encountered or received information about in Ukraine are based on regular Starlink hardware. Some terminals arrive already configured for Starshield service. Others can be provisioned for it through the appropriate channels. The key point is simple: A regular Starlink terminal operating under an authorized Starshield service configuration is still a Starshield terminal from the service perspective. It does not need to be physically modified or “hacked” to obtain that service. #⃣ 5. Why does a Starlink/Starshield terminal require GPS? Three years ago, I published an article explaining why GPS is important for Starlink terminals and how to improve GPS reception on the hardware available at that time: olegkutkov.me/2023/11/07/con… Some of the technical details in that article are now outdated, but the fundamental principles remain relevant. A Starlink terminal requires sufficiently accurate position and timing information for network synchronization, beamforming, and other aspects of normal operation. Location information can also be used for geographic service authorization. Invalid or spoofed GPS data may interfere with these processes. Depending on the magnitude of the error and the firmware's ability to detect it, the terminal may lose connectivity or become unable to operate normally. Modern firmware also includes mechanisms to detect suspicious or inconsistent GPS information. When GPS data is considered unreliable, the terminal may attempt to use an alternative source of positioning, navigation, and timing (PNT) information derived from Starlink's own satellite constellation. However, this fallback mechanism is not guaranteed to work reliably under every operating condition. This distinction helps explain why some hardware modifications focus on improving GPS reception or supplying more reliable positioning data, rather than bypassing Starlink's network authorization mechanisms. #⃣ 6. What is Starlink PNT? Starlink PNT is a positioning, navigation, and timing capability that derives information from signals transmitted by Starlink satellites. By combining satellite measurements with known orbital information, a terminal can estimate its position and movement independently of a conventional GPS receiver. Starlink firmware contains the necessary functionality to process these measurements and use them as an alternative positioning source. Initially, this functionality was more of an experimental feature. It was interesting from an engineering perspective, but its accuracy and reliability were limited. Over time, it has improved significantly. Modern implementations can provide useful positioning information, including when a terminal is moving. There are still measurement errors, uncertainties, and limitations, but Starlink-derived PNT can serve as an alternative when GPS is unavailable or unreliable. Nevertheless, conventional GNSS remains an important and generally preferred source of positioning and timing information in current terminal designs. For now. Can the terminal operate without GPS? Under certain conditions, yes. Starlink firmware provides a gRPC request called `dish_inhibit_gps`, which controls whether GPS is used as a position source. When GPS use is inhibited, the firmware can attempt to rely on alternative positioning information. A similar situation occurs when GPS data becomes unavailable because of hardware or communication problems. However, disabling GPS does not guarantee that the alternative positioning solution will be sufficiently accurate or available. It also does not automatically change the terminal's service permissions. #⃣ 7. How does a Starlink terminal determine its moving speed? The GPS receiver is a primary source of position and velocity information. Proprietary NMEA messages, including `TMPV`, carry information the terminal's motion-processing logic uses. The firmware does not necessarily trust these measurements without additional validation. The firmware can filter GPS-derived velocity and compare it with information from other available sources, including Starlink-derived positioning. The terminal also contains an inertial measurement unit (IMU), whose acceleration measurements can help evaluate movement and detect inconsistencies. The firmware applies thresholds and consistency checks to these measurements. These mechanisms run internally and aren't exposed as user-configurable settings. If GPS measurements differ significantly from the expected values or fail validation, the firmware can reject them. However, GPS validation and service-speed enforcement are two different things. Rejecting GPS data does not automatically mean that the terminal has exceeded the permitted operating speed. The terminal's service configuration determines whether operation at a particular speed is authorized. When the relevant speed policy is violated, the terminal may report a condition such as: `MOVING_TOO_FAST_FOR_POLICY` This distinction is essential when evaluating claims about GPS modification. Simply changing GPS-reported velocity does not automatically change the terminal's authorized operating speed or eliminate the firmware's internal validation mechanisms. As explained earlier, appropriately provisioned Starshield service supports high-speed operation without the same restrictions imposed on ordinary commercial configurations. Therefore, no additional “hacking” is required to obtain high-speed capability when that capability is already authorized as part of the service. Reliable GNSS reception remains desirable, however. This is one reason specialized terminal designs may incorporate improved receivers, such as the Teseo V used in the `mini1_rugged` variant. It also explains the existence of solutions intended to improve GPS reception or provide a more reliable PNT input. **Improving positioning reliability is not the same thing as bypassing service authorization.** #⃣ 8. How does Starlink geofencing work? There are two important factors: geographic service authorization and physical RF coverage. Understanding the difference is essential. Geographic service authorization Starlink uses geographic information to determine where service is available and whether a particular terminal is authorized to operate. The system uses logical geographic regions rather than relying exclusively on the physical boundaries of satellite beams. H3 is one geographic indexing system relevant to this discussion. It divides the Earth's surface into hierarchical hexagonal cells that represent geographic locations and regions. Geographic indexing provides a convenient way to manage coverage and service policies, but an H3 cell should not be confused with a physical satellite beam. Network authorization can depend on several factors, including geographic location, service configuration, terminal identity, and applicable restrictions. A terminal may be physically capable of receiving a satellite signal while still being denied access to the service. This is an important distinction when discussing restricted territories, including russia. Receiving a Starlink signal does not necessarily mean the terminal is authorized to connect to the network. Physical RF coverage Satellite beams cannot perfectly follow national borders or the boundaries of geographic indexing cells. An RF beam has a physical footprint determined by the satellite antenna, beam steering, operating conditions, and geometry. Its boundaries are not perfectly sharp. Consequently, a beam may illuminate areas on both sides of a national border even though the service is authorized on only one side. This is a normal characteristic of satellite communications, not evidence that geographic service restrictions have been disabled. The role of GPS in geofencing The terminal's reported location provides another source of information for determining whether it is operating in an authorized region. The network can use terminal positioning information, together with its own authorization rules, to determine whether service should be permitted. When operation is prohibited, the terminal may receive an appropriate disablement code from the network. These mechanisms should be understood as parts of a broader service authorization system, rather than as a single GPS check controlling everything. Can geofencing be bypassed by supplying modified GPS coordinates? This question requires some nuance. Changing the location reported by a GPS receiver may influence positioning-dependent decisions, but it does not automatically override network authorization. Starlink also has other information available to evaluate terminal operation, and its firmware includes mechanisms for detecting inconsistent positioning data. Large discrepancies can disrupt normal positioning and beamforming calculations, trigger validation failures, or cause the terminal to lose connectivity. Most importantly, changing GPS coordinates does not by itself grant a terminal permission to use a service or geographic region for which it is not authorized. #⃣ 9. So what exactly is being called a “Starlink hack”? This is where much of the confusion comes from. The modifications being discussed online are primarily related to improving GPS reception or providing the terminal with reliable positioning and timing information. These are technical solutions intended to improve connectivity and stability, particularly when the terminal is moving or operating in an environment with GPS interference. They do not automatically bypass Starlink's speed restrictions, geographic limitations, or network authorization mechanisms. As explained earlier, regular Starlink hardware can also operate under an officially authorized Starshield service configuration, which supports high-speed military applications. Neither improving GPS reliability nor using an authorized Starshield service constitutes hacking Starlink. It's important to understand these differences before making accusations based on photographs, rumors, or incomplete technical information. #⃣ Conclusion Starlink and Starshield use closely related technologies, but they are different services with different capabilities and restrictions. Regular Starlink hardware can operate under an officially authorized Starshield service configuration. No special hardware modifications are required. Improving GPS reception or providing reliable positioning data does not mean bypassing Starlink's network restrictions. Using Starshield for authorized military operations is not hacking. Neither is improving a terminal's GPS reliability. My goal is simply to explain how these systems work and clear up the confusion surrounding them. Technical accusations should be based on evidence, not rumors. #starlink #starshield #gps
103
354
118
1,156
143,586
Did @DropSiteNews knowingly publish illegally obtained classified CIA intelligence? On October 5, the outlet co-published Aída Chávez’s story claiming a secret CIA assessment warned Israel could descend into civil war. That date is now in an FBI leak affidavit🧵
2
112
John Hendricks retweeted
I see people are back to praising Russia for releasing one more American they held hostage yesterday. The reality is, that means Russia is still holding at least 8 more American hostages. The number should be zero. That’s 8 more reminders of why Putin isn’t our ally and why Russia isn’t our friend. Here’s my Op Ed from September: thehill.com/opinion/internat…
524
712
25
5,126
94,896
Lucy, an incredible 15-year-old blind and neurodivergent pianist from Yorkshire, performed Bach’s beautiful “Prelude in C” alongside her teacher, Daniel, before an audience of 6,000 at the Royal Albert Hall. Bach himself might have shed tears if he had lived to hear her perform this piece. Tears of amazement. Tears for a young girl who lives with blindness yet has been blessed with a soul that expresses such beauty through her music.
48
379
37
2,029
73,765
John Hendricks retweeted
Remember when this guy was convicted of making false statements to the FBI about contacts with Russian spies (and receiving money from Russians)?
471
3,907
133
16,732
235,990
John Hendricks retweeted
Je vais dire quelque chose qui risque de déplaire à beaucoup de monde, mais tant pis. Je crois qu’une partie de notre société est en train de perdre quelque chose de bien plus grave que sa compétitivité économique. Elle est en train de perdre sa capacité à rêver. Hier, Tesla a présenté une démonstration spectaculaire autour d’une voiture capable de quitter le sol. Un prototype, certes, pas encore la voiture volante de Retour vers le futur. Mais quand même, bordel. On parle de technologies qui semblaient relever de la science-fiction quand nous étions gamins. Et ce matin, en regardant certaines réactions françaises, qu’est-ce que je découvre ? « Ça sert à rien. » « Musk est un raciste. » « Ça ne règle pas les problèmes de recharge. » « Ça n’efface pas ses saluts nazis. » Mais sérieusement, qu’est-ce qui nous est arrivé ? À quel moment avons-nous perdu cette âme d’enfant qui nous faisait ouvrir grand les yeux devant une invention ? Et le plus triste dans tout ça, c’est qu’on semble avoir oublié notre propre histoire. La France, c’est le pays des frères Lumière, qui ont contribué à faire naître le cinéma. C’est le pays de Louis Pasteur, dont les travaux ont révolutionné la microbiologie et la vaccination. C’est le pays de Nicéphore Niépce, pionnier de la photographie. C’est le pays des frères Montgolfier, qui ont envoyé l’être humain dans les airs à bord d’une montgolfière. C’est le pays de Blaise Pascal, qui concevait déjà une machine à calculer au XVIIe siècle. C’est aussi le pays du TGV, et l’un des deux pays qui ont donné naissance au Concorde. Vous imaginez ce que représentaient ces inventions à leur époque ? Des humains qui osaient accomplir ce que beaucoup pensaient impossible. Des gens qui n’acceptaient pas les limites de leur temps. Des visionnaires, des ingénieurs, des scientifiques, des entrepreneurs qui voulaient repousser les frontières du réel. Nous avons été ce pays-là. Alors comment avons-nous pu en arriver à un point où notre premier réflexe devant l’extraordinaire semble parfois être de chercher pourquoi il faudrait le mépriser ? SpaceX récupère des fusées qui reviennent se poser sur Terre ? On parle immédiatement d’Elon Musk et de ses provocations. Des robots humanoïdes commencent à réaliser des tâches physiques de plus en plus complexes ? « Ça va détruire des emplois. » L’IA ouvre des perspectives gigantesques pour la médecine, la science, l’éducation et la création ? « Ça pollue, ça vole le travail des artistes, ça sert à tricher. » Un entrepreneur annonce vouloir réaliser quelque chose d’incroyable ? « Encore un milliardaire qui veut s’en mettre plein les poches. » Mais est-ce qu’on réalise seulement ce qui est en train de se passer ? Nous vivons une époque où des fusées réutilisables se posent après leur mission, où l’IA accélère certaines découvertes scientifiques, où des robots apprennent à évoluer dans notre monde, où des personnes seules commencent à créer des choses qui nécessitaient auparavant des équipes entières. Et devant tout ça, on serait devenus incapables de dire simplement : « Putain, c’est incroyable. Comment est-ce qu’ils ont réussi ça ? » Je ne demande pas qu’on admire aveuglément les milliardaires. Ni qu’on ferme les yeux sur les conséquences sociales, environnementales ou politiques de leurs projets. On peut condamner les propos d’Elon Musk tout en reconnaissant les prouesses des ingénieurs de SpaceX et de Tesla. On peut défendre les travailleurs tout en trouvant la robotique fascinante. On peut vouloir encadrer l’IA tout en étant émerveillé par ses possibilités. L’esprit critique n’a jamais obligé personne à devenir cynique. Et c’est justement ce cynisme qui me désespère. J’ai parfois l’impression qu’on a remplacé l’admiration par la jalousie, le goût du risque par la peur de l’échec, l’ambition par la suspicion et le rêve par le sarcasme.
781
1,477
227
8,710
448,521
So let me get this straight... Russia uses IRANIAN Shahed Drones; Russia uses NORTH KOREAN troops; Russia uses CHINESE funding; Russia helped ASSAD's Syrian regime; Russia helped Maduro's Venezuelan regime. And YOU, as a MAGAT American, think it's patriotic to help Russia???
223
545
16
4,015
69,342
John Hendricks retweeted
Truth is truth
Trump's own intelligence agencies say Russia is helping Iran target American troops, but he'd rather believe Putin. @michaeldweiss tears into Trump's humiliating deference to the Russian dictator: "He just looks like a pathetic fucking cuck."
4
78
1
260
8,187
We never communicate what we will do next in our operations. Last night, we did not attack any energy facilities on the territory of Russia because President Trump said that there would be an energy ceasefire between Ukraine and Russia. We did not attack, while Russia attacked our gas stations, energy infrastructure, and other facilities. I think it was Putin’s answer to President Trump. And the message from Russia was very clear – they don't know anything about the energy ceasefire. It's a pity, because they always find reasons not to stop this war. Which is why I think we need more pressure on Russia. From an interview with Fox News.
1,403
10,385
280
58,782
1,052,733
Seems reasonable
🔴 Zelenskyy: "Don't attack us, don't kill our children. We will stop attacking your diesel. I think it's a fair deal."
3
126
John Hendricks retweeted
Abdul El-Sayed’s sister is deleting posts admitting that her family are active within the Muslim Brotherhood. It would be a shame if this went viral.
357
24,201
444
55,995
637,853
We are now allied with Russia to lower the price of diesel that is sky high because of our war against Iran, who is being supported by…. Russia Do i have that right?
1,167
6,895
219
36,807
384,371
John Hendricks retweeted
I would like to remind everyone that Russia provided intelligence to Iran that led to the deaths of Americans in the Persian Gulf.
221
729
26
3,911
63,148
John Hendricks retweeted
CAUGHT RED-HANDED: In my new investigation @FoxNews Digital, I lay bare the invisible (red) hand behind the communist-led protests spreading from France to Belgium. Next: India. I encourage you to read the full story so you can know all of the players: foxnews.com/world/behind-fra…
A Fox News Digital investigation traces how France's student protests over education cuts are being hijacked by a sprawling network of communist activists, labor unions and far-left political parties — all amplified by a transnational propaganda machine funded by Neville Roy Singham, an American-born tech tycoon based in China who supports the Chinese Communist Party. Fox News Digital's senior editor of investigations @AsraNomani tracked 50 groups in a 'red-green alliance' involved in a transnational network organizing, promoting and amplifying the student protests in France. – Only 15 groups, or 1 of 3, is a youth student group The 35 other groups for adults are all left-leaning. – 12 labor groups – 8 communist or socialist organizations – 5 civil-rights and human-rights groups – 5 groups focused on issues from taxes to media – 4 political parties, including La France insoumise and French Communist Party – 1 Palestinian advocacy group On the ground in Paris, the hammer and sickle flies alongside Palestinian flags. The French Communist Party's national secretary poses with protesters. Far-left politicians from La France Insoumise pose for photos with students. Groups like the Young Communists Movement of France march behind bright red banners reading "Class War" and demanding an end to "Imperialist Wars." "What we're seeing here is the same Red-Green ecosystem that disrupts infrastructure chokeholds in our country such as the Brooklyn Bridge, college campuses and congressional hearings," says Heritage Foundation senior fellow Mike Gonzalez @Gundisalvus. In the U.S., BreakThrough News — a pro-communist outlet in the Singham network — pushes the protests to a global audience, racking up hundreds of thousands of likes, including from influencer Hasan Piker, on dramatic anti-police clips while laying the groundwork for the next student explosion, this time in India.
124
1,656
148
3,963
311,588
John Hendricks retweeted
Ukraine should do the funniest thing over the next half month and knockout Russia's Baltic Sea terminals at Port of Primorsk Port of Ust-Luga Port of Vysotsk Port of St. Petersburg Port of Kaliningrad Port of Vyborg
27
117
8
1,012
11,632
wow
中国共産党が1989年6月4日、天安門広場で学生運動を武力弾圧した未公開の衝撃映像が、ついに明らかになった📺 英国ITNが30年間封印してきたオリジナル映像が、ついに解禁された🔓
3
244
John Hendricks retweeted
HOLY SH*T CNN officially just ABANDONED Abdul El-Sayed after he REFUSED to condemn terrorist organizations. There's actually no recovering from this. He's done for.
1,415
8,062
340
42,911
1,969,002
John Hendricks retweeted
RIP to 18 brave Americans. We never forget. 🇺🇸🙏🫡
Today in 1993, two U.S. Blackhawk helicopters are shot down over Mogadishu, Somalia. 18 Americans are killed and 73 are wounded during the fight to recover the crews. Hundreds of Somalis die in the battle. The debacle leads to a scaling back of America's mission in the region.
8
28
284
8,711