Physical consequence mapping of cyber attacks on infrastructure
When a cyber-physical attack on a power station or water plant is suspected and ground access is denied, optical and SAR change detection provides the evidentiary layer that intelligence reports alone cannot. Coherence loss, thermal change and night-light collapse each tell a different part of the story.
Sensors
- Sentinel-1 SAR (C-band, ESA): Interferometric coherence at 5x20 m (IW mode); 6-day revisit at mid-latitudes, 12-day globally. Coherence loss between pre- and post-event passes flags surface disturbance, rubble, removed equipment or flooded transformer bays even under cloud or smoke cover.
- Maxar WorldView Legion: 30 cm panchromatic, 1.2 m multispectral; up to 15 revisits per day over priority targets. Resolves individual transformer units, cooling towers and vehicle presence. Tasking latency is typically hours, subject to cloud and tasking queue.
- Planet SkySat: 50 cm resolution, up to 12 revisits per day. Useful for rapid daily comparison when Maxar tasking is unavailable; resolves equipment-bay changes and fire damage at substation scale but not individual component detail.
- VIIRS Day/Night Band (DNB, NOAA/NASA): ~750 m pixel, nightly overpass. Detects radiance change consistent with grid blackout or facility shutdown at city or district scale. Sensitivity floor around 2×10⁻⁹ W cm⁻² sr⁻¹; cannot resolve individual facilities but provides corroborating blackout extent.
- VIIRS MODIS Thermal (FIRMS): 375 m active-fire and thermal-anomaly detection; 1-2 daily passes. Identifies post-attack fires at large industrial sites. Cannot distinguish attack-induced fire from accidental fire without corroborating optical or SAR data.
Why satellites see what inspectors cannot
A cyber-physical attack on critical infrastructure rarely announces itself cleanly. The Industroyer/Crashoverride malware that triggered the December 2016 Kyiv blackout left no visible crater. The 2022 Ukrainian grid strikes combined kinetic and electronic means in ways that made attribution difficult from open sources. In both cases, the physical consequences, equipment removal, fire damage, transformer explosions, cooling-system failure, were legible from orbit even when ground access was controlled or contested.
Satellite observation does not replace signals intelligence or forensic network analysis. What it adds is a time-stamped, spatially precise record of what changed at a specific facility between two dates. That record is admissible as open-source evidence, reproducible by any party with archive access, and unaffected by information denial on the ground.
What a coherence map gives away that an optical image cannot
Sentinel-1 interferometric coherence compares the phase relationship of two SAR passes over the same ground. A stable surface, concrete, metal roofing, intact transformer banks, maintains high coherence. Disturbed surfaces, rubble, removed equipment, flooded bays, freshly turned earth, scatter the phase signal and appear as coherence loss in the difference image. Cloud and smoke are transparent to C-band radar, which is precisely why coherence analysis was central to damage mapping during the 2022 Ukrainian conflict when optical collection was frequently obscured.
The practical limit is the 6-to-12-day revisit gap. An attack that is repaired within that window may leave only partial coherence signal. Fine-resolution SAR from commercial providers (Capella Space, ICEYE) can close that gap to hours on tasking, though at higher cost and narrower swath. Sentinel-1 remains the baseline because its archive extends to 2014 and its data are free, giving analysts a long pre-event baseline for coherence statistics.
Reading a substation from 30 centimetres
At 30 cm resolution, a WorldView Legion image of a high-voltage substation resolves individual transformer units (typically 5-15 m long), busbar connections, cooling radiators and circuit-breaker arrays. Removal of a transformer, a common consequence of both kinetic strike and deliberate equipment theft following grid disruption, appears as a cleared pad with residual oil staining. Fire damage shows as charring on rooftop surfaces and collapsed structural elements. The analytic workflow is a pixel-level change detection between a pre-event baseline image and a post-event collect, with manual review of flagged objects.
Honest limits apply. Sub-30 cm optical collection is weather-dependent; persistent cloud over Ukrainian winter targets was a documented constraint in 2022-23 analysis. Smoke from ongoing fires can obscure a site for days. And optical change detection tells you what changed in appearance, not why. A transformer removed for maintenance looks identical from orbit to one removed after an attack. Temporal context and corroboration with VIIRS thermal and SIGINT reporting are necessary to distinguish the two.
Night-light collapse as a damage indicator
VIIRS DNB has been used systematically to track electricity access loss in conflict zones, including peer-reviewed analysis of the 2022 Ukrainian grid attacks published in remote-sensing literature. A facility that was radiating at a stable nightly radiance and then drops to background within a single overpass window has experienced either a planned outage or a forced shutdown. Comparing the spatial extent of the radiance drop against the known grid topology, publicly available from OpenStreetMap and national grid operator filings, allows analysts to infer which substation or generation node is the likely failure point.
The 750 m pixel size means VIIRS cannot isolate a single facility in a dense urban area. It is most useful for large industrial sites (thermal power stations, water-treatment complexes) that occupy several pixels, and for mapping blackout extent at district or city scale to bound the physical consequence of an attack. Radiance recovery over subsequent nights is itself informative: slow recovery suggests structural damage; rapid recovery is more consistent with a software-induced trip that was manually overridden.
Building the evidentiary package
A credible consequence assessment combines at least three independent observation types. SAR coherence establishes that the surface changed. Optical imagery characterises what changed and, where resolution permits, what was removed or destroyed. VIIRS DNB quantifies the operational impact in terms of light output lost. Where a thermal anomaly is present in FIRMS data, it adds a fire or heat-bloom event to the timeline. Each layer carries its own timestamp and sensor metadata, which is what makes the package useful as open-source evidence rather than assertion.
Satellize structures this workflow as a time-ordered change dossier: pre-event baseline statistics, event-window change layers, post-event recovery tracking and a written assessment of confidence and ambiguity. The Kingdom of Tonga crop-estimation programme demonstrated the same multi-sensor fusion logic in a civilian context; the defence application demands higher update frequency and tighter chain-of-custody documentation for the imagery provenance. Analysts working on denied-access targets should expect to spend as much time on uncertainty characterisation as on the detection itself. Ambiguity is not a failure of the method; it is honest reporting.
What this method cannot do
Satellite observation cannot attribute a physical change to a cyber cause rather than a kinetic, accidental or maintenance cause. It cannot see inside a facility: control-room damage, corrupted firmware, destroyed SCADA hardware are invisible from orbit. It cannot detect an attack that leaves no physical trace, which is the defining characteristic of the most sophisticated intrusions. And it cannot substitute for on-site inspection when legal proceedings require chain-of-custody evidence collected under defined protocols.
The method is strongest when used to corroborate or refute claims, to establish a timeline of physical change, and to bound the geographic extent of operational impact. Those are genuinely useful functions for a government assessing whether a reported cyber attack on a neighbour's grid actually caused the damage claimed, or for an insurer evaluating a war-risk claim, or for a national security agency building an open-source annex to a classified assessment.
Typical figures
| Best optical resolution | 30 cm (Maxar WorldView Legion panchromatic) |
| SAR resolution (Sentinel-1 IW) | 5 m range × 20 m azimuth; 250 km swath |
| Sentinel-1 revisit | 6 days at mid-latitudes (two-satellite constellation); 12 days single-satellite |
| WorldView Legion revisit | Up to 15 times per day over priority targets |
| VIIRS DNB pixel size | ~750 m; nightly overpass |
| VIIRS FIRMS thermal resolution | 375 m (VIIRS active fire); 1 km (MODIS) |
| Minimum detectable blackout extent (VIIRS DNB) | City-district scale (~1 km²); individual facility requires optical or SAR corroboration |
| Sentinel-1 archive depth | 2014 to present (free, open access) |
| Coherence change detection latency | 6-12 days (Sentinel-1 free); hours (commercial SAR on tasking) |
| Delivery formats | GeoTIFF change layers, coherence difference maps, PDF/HTML time-ordered dossier, GIS-ready vector annotations |
Analytics Satellize can run
| SAR coherence-loss map | Interferometric coherence differencing between pre- and post-event Sentinel-1 IW SLC passes; thresholded against long-baseline statistics | GeoTIFF coherence-difference layer with flagged low-coherence zones and confidence classification |
| Optical equipment-change detection | Pixel-level and object-level change detection on Maxar or SkySat time-series; manual analyst review of flagged objects against pre-event baseline | Annotated image pair with change polygons, object-level change log and written assessment |
| Night-light blackout extent map | VIIRS DNB radiance differencing (pre-event mean vs. post-event nightly values); grid-topology overlay to infer failure node | Radiance-change GeoTIFF, blackout-extent polygon, recovery timeline chart |
| Thermal anomaly timeline | FIRMS VIIRS active-fire and thermal-anomaly product ingestion; temporal filtering against pre-event baseline fire frequency at site | Event-flagged thermal timeline CSV and map layer; integrated into change dossier |
| Multi-sensor consequence dossier | Fusion of coherence, optical, DNB and thermal layers into time-ordered event reconstruction; uncertainty characterisation per layer | Structured PDF/HTML dossier with provenance metadata, confidence ratings and open-source corroboration annex |
| Recovery monitoring feed | Automated Sentinel-1 coherence and VIIRS DNB ingestion on each overpass post-event; alert on radiance or coherence recovery crossing threshold | Weekly update reports and optional alert feed (email or API) for defined facility watchlist |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.