You're assuming it requires specialized military gear, as opposed to consumer gear with a flashed firmware. I believe GPS L1 C/A subframe 4 is on the ordinary L1 C/A civil signal, which means commercial receivers can receive it. They just can't (ordinarily) decrypt it. But a few KB of extra code would change that. A pretty broad set of Android phones can receive this data, without even needing to reflash the GPS firmware: you can decrypt on the application processor, since this field is readable.