Appearance
Satellite Orbits Supply Chain
EGV Level: 2 — Global · Geometric | Date: September 2026 | Version: 7.1
Reference: EGV White Paper V7.0 (GGOS, January 2026) · Guiding Principles v4.6 · 1st Joint Development Plan
Major revisions:
- v7.1 — Replaced the raw
data/project/agy_research_findings_function_validation.mdfilename reference in the v7.0 entry below with a working link to the hosted portal (un-ggce.merchantsofmalta.com) — the file itself was also missing from the portal's publish list, fixed in the same pass (cloudbuild.yaml). Part of a sweep across the whole deliverable set for the same issue, per the user's request. - v5.6 — Renamed the per-capability "Phase 1/2/3" priority tag to "Horizon 1/2/3", matching the framework used throughout Work Assignment 1b.
- v5.9 — Corrected the 2013 NRCan/ESA contingency's characterisation to a real, if informal and unrehearsed, ad hoc response — an earlier version had described it as a conflation with an unrelated software launch.
- v6.0 — Added the Capability Evidence Trail (confirmed / asserted / considered / queued), classifying all 18 capabilities scored in this document — the pilot for the method the other four Work Assignment 2 annexes also use.
- v7.0 — Converted from the retired five-tier structure to seven real functions (F1...F7), following Work Assignment 2 v5.0's precedent and the same external validation pass checked against primary IGS/ILRS sources (full findings). Tier 0 split into F1 (Global Multi-GNSS & DORIS Tracking) and F2 (First-Mile Telemetry & Station Ingestion) — the prior bundling obscured that the three Operational Data Centres are a distinct, entirely Northern-Hemisphere-concentrated function, not part of the tracking network itself. Tier 1 becomes F3 (Regional & Global Archiving & Equalization); Tier 2 becomes F4 (Technique Analysis Centre Processing); Tier 3 becomes F5 (Multi-Centre Orbit & Clock Combination). Tier 4 split into F6 (Orbit Validation & Independent SLR Quality Assurance — new content: SLR Data Acquisition and Storage has been scored in Work Assignment 2 since before this pass, but never had a home in this annex's own tables or narrative until now) and F7 (Global Product Dissemination & Real-Time Streaming). Matching Work Assignment 2 v4.0/v5.0's own precedent, removed the retired Tier Risk Score / PPTD Gap × Step Criticality apparatus and the per-capability Horizon 1/2/3 tag throughout — PPTD scores are shown as descriptive context only, per function; that computation is Work Assignment 3's job. Corrected the PPTD averaging convention to exclude not-applicable dimensions rather than scoring them 0 (matching Work Assignment 1b v7.0's Annex A.2 correction) — this changes several displayed averages (Risk Management 0.50 → 1.00; Performance Management 1.00 → 2.00; Disaster Recovery 1.25 → 1.67) without changing any underlying evidence; Performance Management's corrected figure also resolves the "artifact, not a real floor failure" finding Work Assignment 3 already flagged independently for this same capability. Note for Work Assignment 3: the Tier Risk Score/Step Criticality figures this annex previously carried, which Work Assignment 3 currently cites as source data, are removed here — Work Assignment 3 itself still runs the pre-v1.6 method and has not yet been updated to match; this is a known, flagged follow-up, not an oversight.
Subsequent versions applied editorial, terminology, and minor factual corrections only unless otherwise noted above.
PPTD (People, Process, Technology, Data) scores: State of Geodesy 2026 — A baseline maturity assessment (UN-GGCE, 16 March 2026)[^sog2026]
Audience
This document serves two readerships: (1) UN-GGCE leadership and technical counterparts already familiar with this engagement; and (2) UN-GGCE staff and Member State stakeholders new to this specific analysis. Readers new to the engagement should read this Purpose & Reading Guide; the function-by-function detail that follows supports the summary findings reported in the Work Assignment 2 and Work Assignment 3 reports.
Purpose & Reading Guide
This is one of five technical workflow descriptions supporting Work Assignment 2 of the UN-GGCE Global Geodesy Supply Chain Assessment (Terms of Reference 2). It maps, function by function, how the GNSS Satellite Orbits product is produced — the institutions involved, the capabilities each step depends on, and where the production chain is most exposed to failure.
Companion Documents
Readers new to this engagement should start with the Critical Product Mapping Report (Work Assignment 2), which maps this product's functions to capabilities, organisations and information artifacts at summary level; the Investment Prioritization and Risk Rubric (Work Assignment 1b), which defines the risk-scoring method; and the EGV Data Levels and Supply Chain Tiers appendix (Work Assignment 1 Appendix), which explains the underlying data-level structure this document's functions are keyed to.
Overview
The Satellite Orbits Essential Geodetic Variable (EGV) sits at Level 2 in the Global Geodetic Observing System (GGOS) EGV framework — it is a processed, combined product derived from raw observation data and delivered as an input to the full suite of Level 3 EGVs. Within the Level 2 category, this supply chain specifically produces the GNSS Satellite Orbits, Clocks and Biases (GOCB) product set: three-dimensional orbital trajectories for all operational GNSS satellites and sub-nanosecond clock corrections for each satellite.
These products are Primary or Important inputs to ten of fourteen Level 3 EGVs, including Global Reference Frames (ITRF), Sea Surface, Sea Level, Ice Sheets, Terrestrial Water Storage, and Atmosphere. The complete dependency matrix is documented in the EGV Product Mapping working document maintained for this engagement.
Critical circular dependency: ITRF is simultaneously a consumer of Satellite Orbits (GNSS data must use precise orbits before contributing to ITRF combination) and a prerequisite for Satellite Orbits production (SPOCC, the orbit combination engine described in F5 below, uses Helmert transformations anchored to the current ITRF). A sustained failure of this pipeline progressively weakens the ITRF itself, cascading to every EGV with a Primary or Important dependency on Global Reference Frames.
Co-Produced EGVs
The same F4–F5 processing that generates Satellite Orbits simultaneously produces several additional EGV products as natural computational byproducts. The F5 ACC/SPOCC bottleneck identified later in this document — ACC, the Analysis Centre Coordinator, and SPOCC, its combination engine, both described in F5 below — is therefore a multi-EGV resilience gap.
| EGV | Level | Mechanism |
|---|---|---|
| Station Positions and Variations | 2 | AC solutions include station coordinate time series (SPTS) in the same computational step |
| Integrated Water Vapour (IWV) | 3 input | Tropospheric delay parameters from orbit determination yield IWV directly |
| Global Ionosphere Maps (GIM) | 3 input | Ionospheric delay estimation during dual-frequency GNSS processing |
| Earth Orientation Parameters (EOP) | 3 input | Polar motion and LOD estimated as part of GNSS combination at F5 |
Governance
| Institution | Role | Risk Level | Governance Gap |
|---|---|---|---|
| International GNSS Service (IGS) Governing Board (IGB) — incoming Chair: Scott Luthcke (NASA GSFC) | Strategic direction and policy authority for the IGS. The International Association of Geodesy (IAG) holds voting membership on the IGB (confirmed by IAG President Richard Gross, May 2026). | Medium | No formal multi-stakeholder representation for space agencies or the private sector as governance actors. No single body is formally designated as accountable for supply chain reliability. |
| IGS Central Bureau (NASA — co-hosted JPL & GSFC) | Operational coordination hub; manages station metadata (Central Bureau Information System, CBIS) | Medium | No formal MoU governing CB hosting at JPL; best-effort institutional arrangement. |
| IGS Infrastructure Committee | Technical standards for tracking network and data flow | Medium | Standards improvement is reactive — triggered by failure. |
| GGOS / IAG | Scientific coordination and EGV framework definition | Low | IAG coordinates science through GGOS but holds no formal seat at IGS operational governance. Scientific leadership and operational accountability remain structurally disconnected. |
| IERS | Validates combined orbits against ITRF | Medium | No formal SLA monitoring loop reporting validation results back to UN-GGCE or GGOS. F6 is not in the current UN-GGCE risk register. |
| UN-GGCE | Advocacy for supply chain resilience; reports to UN Statistical Commission/ECOSOC | Low | Currently holds observer status only within IGS governance. This limits UN-GGCE's ability to enforce JDP Objective 1.1 requirements or mandate remediation when SLA thresholds are breached. |
Supply Chain
Note on PPTD tables below: averages exclude not-applicable dimensions (marked N/A) rather than scoring them 0, per Work Assignment 1b v7.0 Annex A.2. Dimensionality (how many of the four dimensions apply) is shown alongside each average. ⚠ flags a capability whose corrected average falls below 2.5 — stated as one consistent, explicit rule for this version rather than case-by-case judgement.
F1 — Global Multi-GNSS & DORIS Tracking
Data level: Basis — Geodetic Infrastructure. The global GNSS tracking network (106 of the 107 ITRF Core Sites carry a GNSS receiver, plus 553 standard contributing GNSS sites — 659 GNSS sites total) constitutes the Geodetic Infrastructure Basis EGV. Raw observations become Level 1 EGV (Geodetic Observations) upon ingestion to agreed RINEX standards.
Raw GNSS signals are acquired continuously by physical tracking stations. Accountable institutions for individual tracking sites include national geodetic agencies, research institutions, and universities — among them Geoscience Australia, BKG, IGN, and many others across the 107 ITRF Core Sites (106 of which carry a GNSS receiver) and 553 standard contributing GNSS sites, for 659 GNSS-capable sites overall.[^gnss-site-count] While the site network itself is geographically distributed, responsibility for individual site operation is fragmented across these many operators, with coordination managed through the IGS Infrastructure Committee.
The IGS Central Bureau (CB), co-hosted at NASA (Jet Propulsion Laboratory and Goddard Space Flight Center), USA, is the operational coordinator for the entire pipeline — managing the network, maintaining CBIS for station metadata, and ensuring adherence to IGS standards across all seven functions below, not this one alone. CB hosting at JPL rests on no formal MoU; it is a best-effort institutional arrangement. Administrative disruption at JPL would not stop orbit production immediately but would degrade the IGS's capacity to manage station changes, quality issues, and long-term network governance. JDP Objective 1.1 requires a formal hosting agreement. This arrangement is inconsistent with (Principle 3: Centralised Accountability through Multilateral Governance), which recommends that critical operational functions be backed by formalised, multilateral agreements. Key CB personnel are Léo Martire (Director — confirmed as permanent Director 2026-04-16; succession gap resolved) and Robert Khachikyan (Information Systems Manager), who leads the technical management of CBIS, the critical metadata registry.
The IGS Infrastructure Committee (IC) is responsible for standards and coordination of the physical tracking network (F1) and the archiving data flow (F3, below). IC personnel include Markus Bradke (GFZ, Germany — IC Chair, infrastructure strategy), Ryan Ruddick (Geoscience Australia — IC Vice-Chair, cross-function coordination), David Maggert (EarthScope, USA — Network Coordinator, F1 observatory network health), Ignacio Romero (ESA/ESOC, Germany — RINEX standards lead, data interoperability), and Patrick Michael (NASA GSFC/CDDIS, USA — IGS Data Center Coordinator and CDDIS Manager). The IC relies on best-effort contributions from these key individuals. Loss of institutional support for any of these roles — for example, a funding change at EarthScope or GFZ — would immediately degrade global capacity to coordinate the raw data pipeline. No succession plans are documented for any IC role.
Note on DORIS: the PPTD table below carries DORIS Data Acquisition and Storage at the same score as Work Assignment 2's F1 — DORIS-tracked satellites (e.g. Jason, SWOT) produce their own orbit determinations within this same product family. This annex's own narrative remains GNSS-focused; DORIS's specific contribution to this function is not separately documented here, a genuine content gap, not a silent omission of the score.
Risk: Medium — Individual tracking-site operation is fragmented across many independent operators with no succession planning documented for any coordinating role (IGS Infrastructure Committee). This is a key-person and institutional-continuity concern distinct from F2's geographic-distribution finding, below.
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| Ground-Based Asset Management | 3.00 | 2.00 | 2.00 | 3.00 | 4 of 4 | 2.50 |
| Equipment Calibration and Maintenance | 4.00 | 3.00 | 3.00 | N/A | 3 of 4 | 3.33 |
| GNSS Data Acquisition and Storage | 4.00 | 4.00 | 3.00 | 3.00 | 4 of 4 | 3.50 |
| DORIS Data Acquisition and Storage | 4.00 | 4.00 | 4.00 | 4.00 | 4 of 4 | 4.00 |
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision)
F2 — First-Mile Telemetry & Station Ingestion
Data level: Basis → Level 1 EGV transition. The push telemetry connection between a tracking station and its Operational Data Centre (ODC) is where a raw signal becomes a transmitted, receivable observation stream.
Raw GNSS observations are transmitted via push telemetry from tracking stations to Operational Data Centres (ODCs). The primary ODCs are operated by GFZ (Germany), CNES REGINA (France), and NGS/NOAA (USA).
The first-mile connection between a physical observatory and its ODC is a known vulnerability. Many Reference Frame stations lack redundant upload paths. If the primary ODC connection fails, data is buffered locally, introducing latency that degrades real-time and ultra-rapid orbital products. Based on official IGS Network Data Flow topologies, all three primary ODCs are located in the northern hemisphere — a geographic concentration that is unaddressed in current operational risk registers but conflicts directly with (Principle 1: Geographic Distribution for Technical Performance). JDP Objective 1.2 requires regional hubs in under-represented regions, particularly the southern hemisphere.
Risk: Medium — The first-mile connection from observatory to ODC is a known vulnerability; all three primary ODCs are in the northern hemisphere, a geographic concentration that conflicts with (Principle 1: Geographic Distribution for Technical Performance).
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| Network Operations | 2.00 | 2.00 | 1.00 | 3.00 | 4 of 4 | 2.00 ⚠ |
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision)
F3 — Regional & Global Archiving & Equalization
Data level: Level 1 EGV (Geodetic Observations) — RINEX files; geo-located time series with geophysical corrections applied, formatted to agreed IGS standards.
F3 is the ingestion and long-term storage layer, structured as a two-level hierarchy. Regional Data Centres (RDCs) — including BKG (Germany), Geoscience Australia, KASI (South Korea), and SOPAC (USA) — act as geographic consolidators that gather data from multiple ODCs within a region. Above them, the three apex repositories — CDDIS (NASA GSFC, USA), IGN (France), and SIO (Scripps, USA) — form the Global Data Centres (GDCs), which mirror data via a continuous equalization protocol, maintaining synchronised archives across three institutions. Accountable personnel include Patrick Michael (NASA GSFC/CDDIS) as Data Center Coordinator and Ignacio Romero (ESA/ESOC) for RINEX interoperability standards, both reporting through the IGS Infrastructure Committee.
The three GDCs run a data equalization protocol that is architecturally designed to provide resilience against a single GDC-site failure: if CDDIS becomes unavailable, Analysis Centres are intended to be able to pull identical data from IGN or SIO. This mechanism has been invoked at least once: in 2007, following a CDDIS hardware fault, the CDDIS manager directed users to the IGN and SIO mirrors by name.[^cddis-2007] However, no deliberate failover drill, disaster-recovery exercise, or business-continuity test of the equalization protocol appears anywhere in the IGS Technical Reports or the IGS mailing list archive, and no documented instance of an Analysis Centre switching from CDDIS to IGN or SIO was found during either of the two confirmed CDDIS-affecting shutdowns covered in this assessment (2013, 2018–2019); the ongoing 2025 NASA budget and workforce uncertainty is a separate, still-unresolved risk to CDDIS continuity.[^gdc-failover-search] This is an absence of evidence — a station-level switch could occur without being reported to the community, and no usage statistics exist anywhere that would allow this to be checked directly.[^gdc-failover-search] No equivalent disclosure exists for CDDIS, IGN, or SIO themselves; the closest documented parallel is one tier below the GDCs — BKG, a Regional Data Centre, has openly reported having no disaster-recovery capability at all[^bkg-no-dr] — which is suggestive of the wider institutional posture around GDC-adjacent infrastructure. There is a critical need for the equalization protocol to be actively tested and for alternative sources to be made known to operational stakeholders. During a U.S. government shutdown, while automated servers may remain active, the lack of manual support means an untested failover path may not function as intended if it is ever needed.
The equalization protocol operates between GDCs. It cannot recover data that was never delivered to the GDC level in the first place. The correct characterisation of the 2018–2019 shutdown evidence is that the architecture is designed to provide resilience against single GDC-site outage, but this has not been operationally tested (see Risk note below), and the shutdown showed the system was not resilient to ODC/RDC-level data gaps caused by upstream institutional disruption. During that shutdown (35 days), NASA GSFC staff furloughs caused some latency and CDDIS access issues for U.S.-operated sources (e.g., NOAA NGS Analysis Centre disruptions). However, because the Analysis Centre Coordinator (ACC) and other international ACs (e.g., ESA, CODE) remained operational, the global combination was successful. (Source: IGS 2018 Technical Report; no IGSMAIL message specific to the Dec 2018–Jan 2019 shutdown was found in the archive.)
A further concentration risk exists at the political level: CDDIS and SIO are both U.S.-hosted institutions. The GDC network spans only two political jurisdictions (USA, France), which conflicts with (Principle 2: Political Resilience and Distributed Operational Control) and JDP Objective 1.2. There is a critical need for more Global Data Centres with synchronised holdings outside the current U.S./France footprint to ensure geographic and political diversity.
Risk: Medium — The GDC equalization protocol is architecturally designed to provide resilience against single-site failure, but this redundancy is unverified: no failover drill or documented switch to IGN/SIO was found in the historical record, and BKG — an adjacent Regional Data Centre, not one of the three GDCs — has openly reported having no disaster-recovery capability at all, the closest documented parallel available.[^bkg-no-dr] The network also spans only two political jurisdictions. The absence of FAIR-compliant, publicly documented data source registries and of any tested contingency plan conflicts with (Principle 4: Technical Interoperability and Data Accessibility) and (Principle 6: Transparency, Monitoring and Performance Assurance).
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| Data Quality Management | 2.00 | 2.00 | 1.00 | 3.00 | 4 of 4 | 2.00 ⚠ |
| Metadata Management | 2.00 | 2.00 | 1.00 | 3.00 | 4 of 4 | 2.00 ⚠ |
| Data Preservation | 2.00 | 2.00 | 2.00 | 2.00 | 4 of 4 | 2.00 ⚠ |
Note on this table: the Technology dimension of Data Quality Management and Metadata Management scores 1.00 — the weakest score anywhere in this function, reflecting the absence of automated failover, formal monitoring infrastructure, and documented recovery procedures at the GDC/RDC layer.
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision)
F4 — Technique Analysis Centre Processing
Data level: Level 1 → Level 2 (intermediate) — individual AC precise orbit and clock solutions; processed from Level 1 data but not yet combined into the authoritative EGV product.
As registered with the IGS Central Bureau, approximately 12 independent Analysis Centres pull data from the F3 GDC archives and process it to generate independent orbital trajectories and clock corrections. Key Analysis Centres include:
| Analysis Centre | Institution | Software | Methodology |
|---|---|---|---|
| JPL | NASA / Caltech, USA | GipsyX (Proprietary) | Kalman Filter |
| CODE | Univ. Bern / AIUB, Switzerland | Bernese | Batch Least Squares |
| ESA/ESOC | European Space Agency, Germany | NAPEOS | Batch Least Squares |
| GFZ | German Research Centre for Geosciences | EPOS.P8 | Batch Least Squares |
| Wuhan University | China | PANDA | Batch Least Squares |
| + 7 or more others | Various | Various | Various |
While algorithmic diversity across approximately 12 ACs is high, core applications like GipsyX (owned by Caltech) are proprietary and closed-source. This creates a proprietary dependency in F4 — the source code is not available for independent maintenance or inspection. The application is distributed, but the architectural knowledge is not. Algorithmic diversity is encouraged and different software for different regions and purposes is appropriate; however, the closed-source status of GipsyX represents a specific supply chain vulnerability that distinguishes it from the open or published-method tools used by other ACs.
Intermediate solutions produced by individual ACs should be independently archived in accordance with FAIR Principle 4 — ensuring that the authoritative combination at F5 can, in principle, be reconstructed or audited from component parts. This is not currently a documented operational requirement. This gap is directly addressed by (Principle 4: Technical Interoperability and Data Accessibility), which recommends FAIR-compliant data practices and verifiable interoperability across all contributing centres.
Knowledge fragility exists across AC teams. These centres are typically led by small specialist groups within academic or research institutions, with no guaranteed funding continuity and no documented succession planning. The retirement or departure of key scientific staff at any major AC could degrade that centre's contribution quality without any formal remediation pathway. (Principle 5: Minimum Capability Maturity)'s recommended target — every required capability at or above Level 2 in every applicable dimension — is not met here: succession planning is not formalised across AC teams.
Risk: Medium — Algorithmic diversity across ~12 ACs is a strength, but GipsyX (JPL/Caltech) is proprietary and closed-source; key-person risk exists across AC teams with no documented succession planning.
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| GNSS Data Processing and Analysis | 3.00 | 4.00 | 3.00 | 4.00 | 4 of 4 | 3.50 |
| Geodetic Software and Tools | 2.00 | 3.00 | 1.00 | 2.00 | 4 of 4 | 2.00 ⚠ |
| Knowledge Management | 1.00 | 2.00 | 1.00 | 1.00 | 4 of 4 | 1.25 ⚠ |
Note on this table: Knowledge Management is shared with F5's table below — the same underlying score applies to both functions, not a duplicated assessment. Amended 2026-08-27: the People dimension of GNSS Data Processing and Analysis is lowered from the global baseline (4.00) to 3.00, propagating the Satellite-Orbits-specific departure that this same paragraph already argued for in prose — succession planning is not formalised across AC teams, which is People-dimension evidence (Process stays at its baseline 4.00; the pipeline itself runs correctly today). JDP Objective 1.4 directly applies.
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision)
F5 — Multi-Centre Orbit & Clock Combination (ACC/SPOCC)
Data level: Level 2 EGV (Satellite Orbits — GNSS Satellite Orbits, Clocks and Biases/GOCB) — the official, authoritative combined product. This is the boundary at which intermediate AC solutions become the recognised EGV.
The independent orbital solutions from the approximately 12 Analysis Centres are mathematically combined to produce the official Satellite Orbits EGV, distributed as three product types:
| Product | Latency | Use Case |
|---|---|---|
| Ultra-Rapid | ≤ 15 minutes | Real-time navigation, space weather |
| Rapid | ≤ 17 hours | Rapid response geodesy, daily EOP |
| Final | 12–18 days | ITRF combination, science reprocessing |
This combination involves two closely related but distinct roles. It is important to distinguish between the many Analysis Centres and the single Analysis Centre Coordinator: there are approximately 12 independent Analysis Centres globally (ESA/ESOC, CODE, JPL, GFZ, Natural Resources Canada, MIT, TU Graz, AIUB, and others), each independently producing its own orbit and clock solution from raw GNSS data. The Analysis Centre Coordinator (ACC) is a single, unique IGS-wide role — there is only one ACC globally — responsible for receiving all individual AC solutions, applying statistical weighting, performing quality control, and running the SPOCC combination software to produce the one authoritative IGS combined product. The ACC manages AC submissions, assigns statistical weights, oversees quality control, and runs the SPOCC software. The ACC role is currently operated by Salim Masoumi (Geoscience Australia) and Tom Herring (MIT) as Co-Leads for daily combination operations. It is transitioning from GA/MIT to GA/NASA GSFC (full operational capability expected late 2025), with the transition managed by Taylor Yates (NASA GSFC, ACC Transition Lead). The ACC environment is deployed on AWS (EC2 and S3, multiple geographic regions), providing infrastructure-level resilience. The Software for Precise Orbit and Clock Combination (SPOCC) is a Python-based tool developed by GFZ and deployed by the ACC. SPOCC is a proprietary tool. The ACC operates SPOCC, but GFZ retains deep architectural knowledge of the software, meaning that a significant software failure or major feature requirement would depend on GFZ expertise to resolve regardless of who is running the combination day-to-day.
Key SPOCC personnel at GFZ are Benjamin Männel (SPOCC Project Lead), Radoslaw Zajdel (orbit combination algorithms), and Ghazal Mansur (clock combination and VCE algorithms).
All decentralised redundancy from F1–F4 converges through this single pipeline. The risk has three distinct components. First, there is no formal backup ACC: no designated successor exists if GA or its partner withdraws. The 2013 ad hoc response involving NRCan and ESA/ESOC demonstrated that a contingency exists in practice, but it has never been formalised, contracted, or rehearsed. Second, proprietary software knowledge is concentrated at GFZ: the ACC operates SPOCC day-to-day, but GFZ holds the deep architectural knowledge. No independent reimplementation exists. A major software failure or significant capability requirement would require GFZ involvement regardless of who is running the combination. This is a software key-person risk. Third, the ACC transition reintroduces political risk: moving the ACC back to NASA GSFC (a U.S. civil service centre) reintroduces vulnerability to U.S. federal appropriations lapses. Moving the ACC back to GSFC without a formalised, internationally governed "break-glass" protocol reintroduces a known single point of failure that the GA/MIT structure, hosted outside U.S. federal jurisdiction, had successfully mitigated.
The historical record is consistent: in both confirmed shutdowns, the ACC's operational continuity tracked its jurisdictional hosting. In the 2013 U.S. Government Shutdown, the ACC (then solely at NOAA/NGS) faced significant administrative disruption. While core IGS products continued through automated scripts and minimal excepted personnel (IGSMAIL-6826), the impact was visible in the governance record: the NGS/ACC was unable to submit its annual report to the technical record for that year. NRCan and ESA/ESOC stepped in with an informal contingency during this period — real, but never formalised, contracted, or rehearsed (see the risk components above). In the 2018–2019 U.S. Government Shutdown (35 days), the ACC (then GA/MIT) remained operationally available because it was hosted outside U.S. federal jurisdiction. While NASA GSFC staff furloughs caused CDDIS access issues and halted submissions from U.S.-funded Analysis Centres (e.g., NGS), the final global orbit products were not degraded. SPOCC successfully generated the orbits using the remaining international Analysis Centres (e.g., ESA, CODE). This is consistent with the decentralised model continuing to function when the ACC itself is not compromised. (Source: IGS 2018 Technical Report; no IGSMAIL message specific to the Dec 2018–Jan 2019 shutdown was found in the archive.)
The 2025–2026 period represents the most severe sustained disruption to US-hosted IGS infrastructure since 2018–2019 — and it coincides directly with the ACC transition to NASA GSFC. In January 2025, the Los Angeles wildfires caused JPL (co-host of the IGS Central Bureau) to close for roughly nine to ten days (IGSMAIL-8553; independently corroborated against contemporaneous reporting — see Work Assignment 2's footnote on this event for the fuller citation). From February 2025 onward, DOGE-related workforce reductions affected staff at NOAA/NGS (an IGS Analysis Centre) and NASA GSFC (which hosts CDDIS — the primary Global Data Centre); JPL separately underwent three documented 2024–2025 layoff rounds (~8% Feb 2024, ~5% Nov 2024, ~11% Oct 2025) — cited precisely rather than as a single blended figure, per Work Assignment 2's sourcing correction to this same event. The US government shutdown of 1 October to 12 November 2025 (42 days) furloughed a substantial share of NASA's civil servant workforce, including GSFC staff sustaining CDDIS and the Space Geodesy Project, during the same period in which the ACC transition to GSFC was under active preparation. No IGS product delivery failure has been attributed to any of these events in the mail archive — consistent with the 2018–2019 pattern in which automated data flows continued even as human oversight capacity degraded — but the administrative impact of the 2025 shutdown specifically will only be visible once the 2025 IGS Technical Report is published. (The 2024 IGS Technical Report was published in May 2025 IGSMAIL-8593; the 2025 report was announced for early 2026 IGSMAIL-8637. JPL wildfire: IGSMAIL-8553/-8555; DOGE workforce reductions: Wired 21 May 2025, Space.com, SpaceNews; Oct–Nov 2025 shutdown: NASA Shutdown Page, Planetary Society 12 Nov 2025.)
A longitudinal review of IGS Technical Reports (2013 and 2018) reveals a persistent pattern of systemic administrative fragility: "No report submitted" entries appear consistently across critical functions. At F3, SIO, IGN, and KASI consistently failed to submit annual reports in both 2013 and 2018. At F5, critical working groups including Clock Products, Orbit Dynamics, and the foundational Reference Frame Working Group (in 2018) failed to document their activities. This represents a major gap in global network monitoring and is a direct manifestation of low maturity in Network Operations. While the supply chain maintains technical data flow, it lacks the administrative resilience and transparent reporting required for a robust intergovernmental infrastructure — a direct gap against (Principle 6: Transparency, Monitoring and Performance Assurance).
One partial mitigation available to NASA GSFC is the U.S. government's "critical activity" designation: functions formally classified as critical under federal continuity-of-operations rules are exempted from appropriations-lapse shutdowns. If the ACC function at GSFC were to receive this designation, automated operations could continue through a funding lapse. However, this designation has not been confirmed for IGS or ACC functions at GSFC — and the 2013 precedent is instructive: the ACC at NOAA/NGS was not classified as a critical activity and was fully furloughed. Critically, even if the designation were granted, it would remain a unilateral U.S. government decision, and could be revoked or re-scoped without notice to the international geodetic community. It therefore mitigates but does not resolve the jurisdictional risk.
The NRCan/ESA contingency demonstrated informally in 2013 remains ungoverned. No SLA, MoU, or trigger criteria exist for activating this failover. No regular rehearsal exercises have been conducted. This arrangement directly conflicts with (Principle 2: Political Resilience and Distributed Operational Control) and JDP Objective 1.1. Formalising this contingency and resolving the ACC transition political risk are prerequisites for this function to meet the standard recommended by (Principle 3: Centralised Accountability through Multilateral Governance).
Risk: Critical — All decentralised redundancy from F1–F4 converges through this single pipeline. No formal backup ACC exists; SPOCC architectural knowledge is concentrated at GFZ; the ACC transition back to NASA GSFC reintroduces U.S. federal political risk that the GA/MIT structure had successfully mitigated. This function fails against (Principle 2: Political Resilience), (Principle 3: Centralised Accountability through Multilateral Governance), and (Principle 5: Minimum Capability Maturity) simultaneously — and, applying Work Assignment 1b v7.0's real Principle 1 test rather than the retired risk-score threshold, also fails (Principle 1: Geographic Distribution)'s Concentration check directly: SPOCC's operational capacity sits entirely at one facility (GFZ), with no demonstrated alternative.
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| Geodetic Data Products | 2.00 | 3.00 | 3.00 | 3.00 | 4 of 4 | 2.75 |
| Performance Management | 2.00 | 2.00 | N/A | N/A | 2 of 4 | 2.00 |
| Risk Management | 1.00 | 1.00 | N/A | N/A | 2 of 4 | 1.00 ⚠ |
| Disaster Recovery and Supply Chain Continuity | 2.00 | 2.00 | 1.00 | N/A | 3 of 4 | 1.67 ⚠ |
| Knowledge Management | 1.00 | 2.00 | 1.00 | 1.00 | 4 of 4 | 1.25 ⚠ |
Note on this table: Performance Management's People and Process dimensions are both at Level 2 — under the prior NA=0 convention this scored 1.00 and read as a floor failure, but that was an artifact of averaging in two genuinely not-applicable dimensions, not a real capability gap (Work Assignment 3 independently flagged this same artifact for this capability). Risk Management and Disaster Recovery remain genuine floor failures on their applicable dimensions.
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision)
F6 — Orbit Validation & Independent SLR Quality Assurance
Data level: Level 2 EGV (Satellite Orbits, pre-publication) — independent verification that the combined orbit product is correct, using a technique other than the one that produced it.
New in this version. Satellite Laser Ranging (SLR) provides an independent check on GNSS-derived orbits: SLR tracking of retroreflectors carried by GNSS satellites detects radial orbit errors using an entirely different measurement principle (optical ranging, not microwave signal processing), coordinated with the International Laser Ranging Service (ILRS) and the IGS Orbit Quality Working Group. This function was scored in Work Assignment 2 before this version but was not previously documented in this annex's own narrative or tables — the gap is being closed here, not silently carried forward.
Risk: Not yet independently assessed in this annex. The SLR validation pathway's own resilience (correlator/analysis-centre concentration, funding basis) has not had the same depth of primary-source review in this document that F1–F5 have. Treat the finding below as a starting point for Technical Product Working Group confirmation, not a settled assessment.
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| SLR Data Acquisition and Storage | 2.00 | 4.00 | 3.00 | 3.00 | 4 of 4 | 3.00 |
| Regulatory Compliance | 3.00 | 3.00 | 3.00 | 3.00 | 4 of 4 | 3.00 |
| Standards Development and Promotion | 3.00 | 3.00 | 3.00 | 3.00 | 4 of 4 | 3.00 |
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision — these three capabilities were previously reported at Work Assignment 2's F0/F4 respectively; reattached here to match the function they actually belong to.)
F7 — Global Product Dissemination & Real-Time Streaming
Data level: Level 2 EGV (Satellite Orbits — validated and distributed) — the Satellite Orbits EGV as validated by IERS and distributed through the IGS archive network and NTRIP streams.
F7 represents the terminal stage of the supply chain: independent validation by the International Earth Rotation and Reference Systems Service (IERS) against the current ITRF, followed by public distribution through the IGS archive network and NTRIP streams, alongside the IGS Real-Time Service (RTS), which broadcasts State Space Representation (SSR) corrections. Accountable institutions are IERS (multi-agency, coordinated through the IERS Central Bureau at BKG, Germany) and the IGS distribution network partners; real-time NTRIP casters concentrate operationally at BKG and CDDIS, a streaming single-point-of-failure distinct from the static FTP archive.
Both validation (IERS) and distribution (IGS) exist and function operationally. However, neither function is governed by formal SLAs, performance targets, or public reporting obligations. F7 does not appear in the current UN-GGCE risk register, which is a gap: if validation is delayed or distribution is degraded, downstream Level 3 EGV pipelines have no formal remediation trigger.
(Principle 6: Transparency, Monitoring and Performance Assurance) and JDP Objective 1.1 recommend formal SLA-based performance monitoring at F7 with published targets for validation turnaround and distribution uptime; a defined escalation process when targets are not met; and integration of F7 metrics into the GGOS/UN-GGCE performance reporting cycle.
Until this governance is established, F7 represents an unmonitored tail risk — adequate under normal operating conditions but without formal accountability if it degrades.
Risk: Not Currently Governed — Validation and distribution exist operationally but are absent from the UN-GGCE risk register. Neither function is covered by SLAs, performance targets, or a formal accountability mechanism. F7 has no formal home in the current risk governance framework; under (Principle 6: Transparency, Monitoring and Performance Assurance) and JDP Objective 1.1, this function would benefit from explicit SLA-based monitoring before it can be more fully assessed.
| Capability | People | Process | Technology | Data | Dimensionality | Avg |
|---|---|---|---|---|---|---|
| Geodetic Services | 2.00 | 2.00 | 2.00 | 2.00 | 4 of 4 | 2.00 ⚠ |
| Data Distribution | 2.00 | 2.00 | 1.00 | 3.00 | 4 of 4 | 2.00 ⚠ |
(Source: State of Geodesy 2026, capability-maturity graph as of sog2026-score-revision)
Capability Evidence Trail
Every capability that appears in this document's function tables — 18 of the 58-capability model — is classified below by how it got its score: confirmed at the shared baseline, asserted with product-specific evidence, considered but not asserted, or queued for future scoring. This is the starting draft the Technical Product Working Group (see Work Assignment 1b, JDP Phase Sequencing) is expected to confirm or challenge.
Confirmed — cited directly in this annex's function tables, at the shared State of Geodesy 2026 baseline, with no product-specific departure asserted (11 of 18 capabilities):
- F1 (2): Ground-Based Asset Management, Equipment Calibration and Maintenance
- F3 (3): GNSS Data Acquisition and Storage — moved to F1's table this version, see note above; Data Quality Management, Metadata Management
- F5 (2): Risk Management, Geodetic Data Products
- F6/F7 (4): Geodetic Services, Regulatory Compliance, Standards Development and Promotion, Data Distribution
Asserted — a product-specific numeric departure from the shared baseline, backed by product-specific evidence (2 of 18):
- GNSS Data Processing and Analysis (F4, People 3.00, avg 3.50) — amended 2026-08-27: succession planning is not formalised across Analysis Centre teams, evidenced directly in this annex's own F4 narrative. Lowers the People dimension from the 4.00 baseline; Process stays at baseline since the pipeline itself runs correctly today.
- Disaster Recovery and Supply Chain Continuity (F5, Process 2.00, avg 1.67) — the 2013 NRCan/ESA contingency is documented, product-specific evidence that an informal continuity response was actually attempted and worked when the ACC was disrupted, distinguishing this capability from Level 1 ("no contingency of any kind exists"). It was never formalised, contracted, or rehearsed, which is exactly why Process sits at Level 2 — something exists, informally — and Technology at 1.00.
Considered and not asserted — evidence exists but doesn't cleanly support a departure (5 of 18):
- Network Operations (F1/F2, avg 2.00) — the IGS Infrastructure Committee's own personnel roster is documented with no succession plan for any role (F1). Real, specific evidence, but the same kind of key-person concentration the already-low baseline is presumably already responding to across the wider capability model — left at baseline deliberately.
- Data Preservation (F3, avg 2.00) — the GDC equalization protocol's one documented invocation (a 2007 CDDIS hardware fault, users redirected to IGN/SIO by name) and BKG's own disclosed absence of disaster-recovery capability cut in different directions — one shows the mechanism has worked once, the other shows an adjacent institution has no DR capacity at all — and don't cleanly support moving the score either way. A Technical Product Working Group member closer to the three GDCs' actual DR posture could resolve this.
- Geodetic Software and Tools (F4, avg 2.00) — GipsyX (JPL/Caltech) is specifically named as proprietary and closed-source, a concrete instance of the Technology-dimension gap the score already reflects. Left at baseline since this corroborates what's already scored.
- Knowledge Management (F4/F5, avg 1.25) — 2024–2025 workforce reductions at NOAA/NGS, NASA GSFC, and JPL (see F5) are specific, sourced, and land directly on the institutions this capability depends on. Already the joint-lowest score in the document; this evidence corroborates the baseline.
- Performance Management (F5, avg 2.00 under the corrected convention) — the absence of any IGS Technical Report for 2024 or 2025, and the documented 2013/2018 pattern of the Clock Products, Orbit Dynamics, and Reference Frame working groups failing to submit activity reports, are specific and directly on-point evidence of a real gap — even though the corrected average itself now sits at the floor rather than below it (see the F5 table note).
Queued — evidenced in this annex's Governance table or JDP Alignment table, not yet added to any function table (3):
- Mandate — Governance table: "No single body is formally designated as accountable for supply chain reliability" (IGB row); UN-GGCE itself "holds observer status only within IGS governance."
- Funding and Investment — JDP Alignment table: Analysis Centre software maintenance runs on "academic teams; no guaranteed funding continuity," mapped to JDP Objective 1.3 (formalised national backing) but not yet scored as its own capability.
- Legal Framework — Governance table: "No formal MoU governing CB hosting at JPL"; F1: CB hosting "rests on no formal MoU, it is a best-effort institutional arrangement"; F7: neither validation nor distribution "is governed by formal SLAs."
If asked why these three aren't scored yet: the same answer the other four annexes give — scoring them properly means running the same per-dimension check the rest of this table went through.
Workflow Diagram
JDP Alignment
| Pipeline Element | Current State | Gap | JDP Objective |
|---|---|---|---|
| CB hosting at NASA JPL | No MoU; best-effort arrangement | Sole institutional host with no formal agreement or continuity plan | 1.1 — SLAs and MoUs for all critical functions |
| ACC operational agreement (GA + MIT → GA + NASA GSFC) | Informal coordination; no SLA | Two Co-Leads with no succession plan; transition back to U.S. federal jurisdiction reintroduces political risk | 1.1 — Formalised long-term operational agreements |
| NRCan/ESA contingency failover (F5) | Demonstrated informally in 2013; never formalised or rehearsed since | Not a governed protocol; no trigger criteria, MoU, or rehearsal | 1.1 — Formal backup agreements |
| Global Network Monitoring | Inconsistent administrative reporting across GDCs and Working Groups (2013, 2018) | Persistent reporting gap; supply chain blind to silent degradation | 1.1 — Network Operations and Monitoring maturity |
| F7 performance monitoring | IERS validates operationally; not in risk register | No SLA-based monitoring, public reporting cycle, or escalation trigger | 1.1 — Transparent accountability mechanisms |
| ODC geographic distribution (F2) | All three primary ODCs in northern hemisphere | No southern hemisphere primary telemetry path | 1.2 — Regional hubs in under-represented regions |
| GDC equalization (F3) | Active synchronisation across CDDIS, IGN, SIO | CDDIS and SIO both U.S.-hosted; only two political jurisdictions represented | 1.2 — Political distribution of critical functions |
| FAIR compliance and ISO Geodetic Register (F3–F4) | RINEX format widely adopted | Interoperability not formally assessed; the ISO Geodetic Register (the standards catalogue in which institutions register interoperable capabilities, per Work Assignment 1) is not linked to operational compliance | 1.2 — FAIR data principles and ISO Geodetic Register |
| AC software maintenance (F4) | Academic teams; no guaranteed funding continuity | Key-person risk with no succession or succession funding mechanism | 1.3 — Formalised national backing for critical capabilities |
| CB Director — Léo Martire | Confirmed permanent Director 2026-04-16 | Succession gap resolved ✓ | 1.4 — Mandated succession planning |
| ACC Co-Leads — Masoumi, Herring (F5) | No documented succession plan | Two individuals accountable for global critical-path combination; no transfer programme | 1.4 — Continuous knowledge transfer |
| SPOCC architecture — Männel, Zajdel, Mansur (F5) | GFZ institutional knowledge; no formal continuity programme | Core engine understood by ~3 people; no independent reimplementation | 1.4 — Succession planning for specialised expertise |
Stakeholder Accountability Matrix
Key individuals whose departure or institutional disruption would have a direct, immediate impact on supply chain continuity. PPTD scores are proxied from the nearest capability matrix entry. ⚠ = succession gap explicitly flagged.
| Individual | Institution | Role | Function | P | Pr | T | D | Succession |
|---|---|---|---|---|---|---|---|---|
| Léo Martire | NASA JPL | CB Director — governance, standards, multilateral coordination | All | 2 | 2 | 1 | 3 | Confirmed permanent 2026-04-16 ✓ |
| Robert Khachikyan | NASA JPL | CBIS Manager — station metadata registry | All | 2 | 2 | 1 | 3 | Not documented ⚠ |
| Markus Bradke | GFZ | IC Chair — infrastructure strategy | F1, F3 | 2 | 2 | 1 | 3 | Not documented ⚠ |
| Ryan Ruddick | Geoscience Australia | IC Vice-Chair — cross-function coordination | F1, F3 | 2 | 2 | 1 | 3 | Not documented ⚠ |
| David Maggert | EarthScope | IC Network Coordinator — F1 observatory network | F1 | 2 | 2 | 1 | 3 | Not documented ⚠ |
| Ignacio Romero | ESA/ESOC | RINEX standards lead — data interoperability | F1→F3 | 2 | 2 | 1 | 3 | Not documented ⚠ |
| Patrick Michael | NASA GSFC | GDC / CDDIS Coordinator — F3 archiving standards | F3 | 2 | 2 | 2 | 2 | Not documented ⚠ |
| Salim Masoumi | Geoscience Australia | ACC Co-Lead — daily combination operations | F5 | 3 | 4 | 3 | 4 | Not documented ⚠ |
| Tom Herring | MIT | ACC Co-Lead — daily combination operations | F5 | 3 | 4 | 3 | 4 | Not documented ⚠ |
| Benjamin Männel | GFZ | SPOCC Project Lead | F5 | 3 | 4 | 3 | 4 | Not documented ⚠ |
| Radoslaw Zajdel | GFZ / Wrocław | SPOCC orbit combination algorithms | F5 | 3 | 4 | 3 | 4 | Not documented ⚠ |
| Ghazal Mansur | GFZ | SPOCC clock and VCE algorithms | F5 | 3 | 4 | 3 | 4 | Not documented ⚠ |
Geographic concentration note: All twelve individuals are based in the USA, Europe, or Australia. No representation from Africa, Latin America, South or Southeast Asia, or the broader Global South. This directly conflicts with Principle 1 (Geographic Distribution for Technical Performance) and Principle 3 (Centralised Accountability through Multilateral Governance), and limits the political resilience of the accountability structure.
PPTD scores are proxied from the nearest capability matrix entry: GNSS Data Processing and Analysis average 3.50 for F4/F5 roles; Network Operations average 2.00 for F1/F3 roles; Metadata Management average 2.00 for the CB.
Glossary
| Acronym | Full Name |
|---|---|
| AC | Analysis Centre |
| ACC | Analysis Centre Coordinator — combines independent orbit solutions from multiple Analysis Centres into the single official product (F5); distinct from CDDIS, which only archives and distributes data (F3) |
| BKG | Federal Agency for Cartography and Geodesy (Germany) |
| CB | Central Bureau (IGS) |
| CBIS | Central Bureau Information System |
| CDDIS | Crustal Dynamics Data Information System (NASA GSFC, USA) — one of three Global Data Centres that archive and distribute raw and processed data (F3); does not perform combination |
| CNES | Centre National d'Études Spatiales (France) |
| CODE | Center for Orbit Determination in Europe (Switzerland) |
| DORIS | Doppler Orbitography and Radiopositioning Integrated by Satellite — one of the four co-located geodetic techniques at ITRF Core Sites |
| EGV | Essential Geodetic Variable |
| ESA | European Space Agency |
| ESOC | European Space Operations Centre (ESA, Germany) |
| FAIR | Findable, Accessible, Interoperable, Reusable — data principles referenced throughout this document and formalised in JDP Objective 1.2 |
| GA | Geoscience Australia |
| GDC | Global Data Centre |
| GFZ | German Research Centre for Geosciences |
| GGOS | Global Geodetic Observing System (IAG) |
| GNSS | Global Navigation Satellite System |
| GOCB | GNSS Satellite Orbits, Clocks and Biases — the specific Level 2 EGV product set this workflow produces |
| GSFC | Goddard Space Flight Center (NASA, USA) |
| IAG | International Association of Geodesy |
| IC | Infrastructure Committee (IGS) |
| IERS | International Earth Rotation and Reference Systems Service |
| IGB | IGS Governing Board |
| IGN | Institut National de l'Information Géographique et Forestière (France) |
| IGS | International GNSS Service |
| ILRS | International Laser Ranging Service — operates the SLR network used for independent orbit validation at F6 |
| ITRF | International Terrestrial Reference Frame |
| JDP | Joint Development Plan (1st JDP) — UN-GGCE's implementation plan, whose objectives are cited throughout this document |
| JPL | Jet Propulsion Laboratory (NASA / Caltech, USA) |
| KASI | Korea Astronomy and Space Science Institute |
| MIT | Massachusetts Institute of Technology (USA) |
| MoU | Memorandum of Understanding |
| NASA | National Aeronautics and Space Administration (USA) |
| NGS | National Geodetic Survey (NOAA, USA) |
| NOAA | National Oceanic and Atmospheric Administration (USA) |
| NRCan | Natural Resources Canada |
| ODC | Operational Data Centre |
| PPTD | People, Process, Technology, Data |
| RDC | Regional Data Centre |
| RINEX | Receiver Independent Exchange Format |
| SIO | Scripps Institution of Oceanography (USA) |
| SLA | Service Level Agreement |
| SLR | Satellite Laser Ranging — one of the four co-located geodetic techniques at ITRF Core Sites; independent orbit-validation technique at F6 |
| SOPAC | Scripps Orbit and Permanent Array Center (USA) |
| SPOCC | Software for Precise Orbit and Clock Combination (GFZ) |
| UN-GGCE | United Nations Global Geodetic Centre of Excellence |
[^sog2026]: United Nations Global Geodetic Centre of Excellence, 2026, State of Geodesy 2026: A Baseline Maturity Assessment, Bonn, Germany, https://www.un.org/globalgeospatial/sites/default/files/2026-05/stateofgeodesy.pdf [^gnss-site-count]: Site counts (106 of the 107 ITRF Core Sites carrying a GNSS receiver; 553 standard contributing GNSS sites; 659 GNSS-capable sites overall) cross-verified against the UN-GGCE capability-maturity and infrastructure named graphs as of August 2026, drawing on the ITRF Core Site network list and official IGS Network Data Flow topologies. [^cddis-2007]: International GNSS Service, 2007, IGSMAIL-5600 "CDDIS server down", https://lists.igs.org/pipermail/igsmail/2007/006971.html [^gdc-failover-search]: Search of the IGS Technical Reports (2013, 2018, 2019) and the IGSMAIL pipermail archive (2013, 2018–2019 date ranges) for failover drills, contingency exercises, and Analysis Centre reports of switching from CDDIS to IGN or SIO during a disruption. None found. No public usage or access statistics exist for CDDIS, IGN, or SIO that would independently confirm whether traffic shifted between centres during either event. [^bkg-no-dr]: International GNSS Service, IGS 2018 Technical Report, p. 159: "A disaster recovery system for the GDC is not installed and not scheduled currently" (BKG Regional Data Center report — BKG is one of the network's RDCs, not one of the three GDCs), https://files.igs.org/pub/resource/technical_reports/2018_techreport.pdf