You’ve spent weeks on your high-altitude balloon payload. The soldering is clean, the code compiles, and the weather window looks perfect. Then you remember: the GPS receiver. If your balloon exceeds 60,000 feet or 1,000 knots, you’re technically breaking the law. And here’s the punchline: the bad guys don’t care.
This regulation doesn’t stop them. It only punishes you.
The CoCom (Coordinating Committee for Multilateral Export Controls) restrictions on GPS receivers were born in the Cold War, designed to keep sensitive navigation technology out of enemy hands. The rules limit civilian GPS receivers to altitudes below 18 km and speeds below 1,000 knots. But in 2025, those limits are a joke. For a few dollars, you can buy an RTL-SDR dongle, sample the L1 frequency with a dumb device that has no idea of speed or altitude, and decode the position using open-source software that’s been in the wild for years. The restriction is a paper tiger, and everyone knows it.
I’ve seen this firsthand. A friend of mine built a CubeSat tracker for a university project. He spent three months navigating the export control paperwork, only to find that the same GPS chip he eventually bought could be bypassed with a firmware update from a GitHub repo. The regulation didn’t stop him—it just made him waste time that could have gone into science.
Here’s the uncomfortable truth: export control regimes like CoCom often accelerate the very circumvention they aim to prevent. When you lock down a technology, the open-source community responds by building workarounds. Need a GPS receiver that ignores altitude limits? There’s a library for that. Want to spoof the output? Done. The restriction becomes a driver of innovation—but not the kind the regulators intended.
Think about the incentive structure. The honest hobbyist reads the rules, tries to comply, and either abandons the project or jumps through hoops. The bad actor—whether a state actor or a smuggler—ignores the rules entirely and buys a military-grade receiver on the black market or builds their own from off-the-shelf parts. The regulation inconveniences the honest and has zero impact on the bad dudes.
This isn’t just about GPS. It’s a pattern that repeats across export controls: the more you clamp down, the more you push the technology into the open, where it becomes harder to monitor. The CoCom restrictions on GPS receivers are a textbook case of regulatory theater—rules that create the illusion of control while doing nothing to change real-world outcomes.
So what should you do if you’re planning a balloon or CubeSat mission? First, understand that the law technically applies to you. Second, recognize that enforcement is virtually nonexistent for hobbyist payloads. And third, stop feeling guilty about it. The system is broken, and pretending otherwise only slows down the people who are trying to innovate. Compliance is a formality, not a barrier.
The next time you’re staring at a blank export control form, remember: the people who wrote these rules were thinking about Cold War missiles, not your weather balloon. They couldn’t imagine a world where a $20 USB dongle and a Raspberry Pi could do the same job as a classified military receiver. That world is here. The rules are not.
We need to stop pretending that outdated regulations protect us. They don’t. They just make honest work harder. And that’s a loss for everyone—except the bad guys, who never had to follow the rules anyway.
FAQ
Q: Does the CoCom regulation actually stop anyone from using GPS at high altitudes?
A: No. Anyone with a $20 RTL-SDR dongle and open-source software can decode GPS signals without any altitude or speed restrictions. The regulation only catches people who try to comply legally.
Q: What's the practical takeaway for someone building a high-altitude balloon?
A: You should be aware that the law exists, but enforcement is rare. Focus on your project and don't let paperwork slow you down. If you're really worried, use a bare RF front-end and do the GPS processing in software—it's trivial to bypass the hardware limits.
Q: Isn't this regulation still necessary to prevent sensitive technology from reaching adversaries?
A: The irony is that the regulation actually accelerates the development of open-source workarounds, making the technology more accessible. A better approach would be to focus on controlling the actual end-use of the equipment, not the hardware itself.