Cellular base station RF mapping in conflict and denied-access zones
Spaceborne RF sensors can detect, geolocate and track the operational status of GSM, LTE and 5G NR base stations without ground access, turning signal presence or absence into intelligence about infrastructure destruction, relocation or deliberate suppression.
Sensors
- HawkEye 360 cluster satellites: Three-satellite formation flying in LEO at roughly 575 km altitude. Uses time-difference and frequency-difference of arrival (TDOA/FDOA) across the cluster to geolocate emitters in the 144 MHz to 15 GHz range. Published geolocation accuracy is on the order of hundreds of metres in open terrain; degrades in dense urban multipath environments. Revisit depends on orbital geometry and tasking priority, typically multiple passes per day over a given latitude band.
- Spire STRATOS wideband RF payload: Hosted on Spire's LEMUR-2 cubesat constellation (100-plus satellites in LEO). STRATOS collects wideband RF data across 700 MHz to 6 GHz, covering the principal GSM 900, GSM 1800, LTE 700–2600 MHz and sub-6 GHz 5G NR bands. High revisit due to constellation size; individual pass duration over a target is short (minutes), so signal detection is probabilistic across passes rather than continuous.
- ITU BR IFIC frequency assignment database: Not a sensor but an essential reference layer. The International Telecommunication Union's Bureau of Radiocommunication International Frequency Information Circular records licensed frequency assignments by country and operator. Cross-referencing detected signals against IFIC entries allows analysts to distinguish licensed carriers from unlicensed or anomalous emitters, and to identify which operator's spectrum is active in a given area.
- Generic LEO RF-SIGINT cubesats (commercial and government): Several smaller commercial operators and government programmes operate wideband receivers in LEO capable of detecting cellular downlink pilot signals. Detection sensitivity depends on receiver noise figure, antenna gain and integration time. At LEO altitudes (400–600 km), link budget calculations suggest that high-power macro base stations (43 dBm EIRP class) are detectable; low-power small cells and femtocells are generally below the detection floor from orbit.
What a downlink pilot signal reveals from 500 kilometres up
Every active GSM, LTE or 5G NR base station continuously broadcasts synchronisation and reference signals on its downlink: the Primary Synchronisation Signal in LTE, the Cell-specific Reference Signal, the 5G NR Primary Synchronisation Signal. These are not optional. A base station that is powered and connected to the network must transmit them. A spaceborne receiver passing over can detect this transmission, record its centre frequency and bandwidth, and note the time of arrival.
The physics are unforgiving in both directions. A macro base station transmitting at 43 dBm EIRP into free space loses roughly 150–155 dB over a 500 km slant range, which is a demanding link budget but within reach of a well-designed LEO receiver with a directional antenna and sufficient integration time. Small cells and indoor units at 23–30 dBm EIRP are effectively invisible from orbit under current commercial sensor sensitivities. That is an honest limit worth stating early: spaceborne RF mapping sees the macro layer, not the full network.
Geolocation: what TDOA/FDOA can and cannot pin down
HawkEye 360's published approach uses a three-satellite cluster in close formation. Each satellite receives the same ground emission at a slightly different time and with a slightly different Doppler shift, because each is at a different position and velocity. Solving the TDOA and FDOA equations simultaneously produces a position estimate. In open, flat terrain with clear line of sight, HawkEye has published accuracy figures in the low hundreds of metres. That is adequate to identify which city district contains an active base station.
Dense urban environments introduce multipath: the signal bounces off buildings before reaching the satellite, arriving via paths that are not the direct line-of-sight route. Each reflected path has a different apparent delay, corrupting the TDOA solution. Accuracy can degrade to one or more kilometres in the worst cases. Analysts working conflict zones should treat urban geolocation results as district-level indicators rather than site-level fixes unless corroborated by optical imagery or prior frequency assignment records that constrain the candidate locations.
Reading the operational picture: presence, absence and change
A single detection pass tells you a transmitter was active at a moment in time. Intelligence value comes from the time series. A base station that was consistently detected across thirty passes over two weeks and then disappears from the record is a meaningful signal: it may have been destroyed, lost power, lost backhaul, or been deliberately shut down. Distinguishing these causes requires corroborating data. Optical or SAR imagery can confirm physical destruction. Power grid monitoring data (where available) can suggest area-wide outages. The RF record alone cannot determine cause, but it reliably records the fact.
Relocation is a subtler signature. A new emission appearing at a frequency previously assigned to a specific operator, at a location not previously active, suggests a mobile base station or a site rebuild. Temporary deployable base stations are widely used by military forces and emergency responders; their spectral characteristics are generally indistinguishable from commercial macro cells at the signal level, though their location relative to known infrastructure may be anomalous.
Sanctioned territories present a different analytical problem. Where a government has restricted spectrum access or where an operator is subject to international sanctions, detecting active transmissions on frequencies that should be inactive is itself the finding. Cross-referencing against the ITU BR IFIC database gives the baseline of what should be transmitting and on what frequency, making anomalous activity identifiable without requiring prior knowledge of the local network topology.
Frequency bands, coverage and the cloud problem that does not apply here
GSM 900 operates around 935–960 MHz downlink; GSM 1800 at 1805–1880 MHz. LTE bands span 700 MHz to 2600 MHz depending on regional allocation; 5G NR sub-6 GHz extends to around 3.5 GHz and 4.9 GHz in most deployed markets. Spire STRATOS covers this range. HawkEye 360's published collection window extends from 144 MHz to 15 GHz, comfortably encompassing all of these.
RF collection from LEO has one significant advantage over optical and SAR remote sensing: it is unaffected by cloud cover, smoke or atmospheric aerosols. A base station transmitting through a thunderstorm is as detectable as one transmitting on a clear day. Night and day are equally irrelevant. The constraint is orbital geometry and revisit, not weather. For conflict zones where persistent cloud or smoke from fires frequently obscures optical collection, this is a meaningful operational advantage.
Honest limits and the corroboration requirement
Several limits deserve explicit statement. First, detection is probabilistic: a single pass may miss an active transmitter due to antenna geometry, interference from adjacent emitters, or the base station being in a low-traffic state that reduces its duty cycle. Confidence in 'station is inactive' conclusions requires multiple non-detection passes, not just one.
Second, frequency reuse is ubiquitous in cellular networks. Multiple base stations in the same city transmit on the same frequency. A spaceborne receiver integrating over a large footprint may see a composite signal from several sites. Separating individual emitters requires either high-quality TDOA/FDOA resolution or prior knowledge of the network plan.
Third, 5G NR introduces beamforming at scale. Massive MIMO base stations transmit directional beams that may not be pointed skyward, reducing the detectable signal at LEO altitudes compared with an omnidirectional assumption. This is an emerging analytical challenge with no fully published resolution in the open literature.
Satellize integrates RF detection data with optical and SAR tasking to cross-validate site status, using the ITU IFIC database as the frequency assignment reference layer.
What an analyst actually receives
A well-structured RF monitoring programme for a conflict zone produces several distinct outputs. A detection log gives time-stamped, frequency-tagged, geolocated emission events per pass. A change layer flags sites that have transitioned from active to inactive (or the reverse) between defined time windows. An anomaly report identifies emissions on frequencies that the IFIC database does not associate with any licensed assignment in the territory, which may indicate improvised, military or illicit infrastructure.
The cadence of these products depends on constellation revisit and client requirements. Daily summary reports are achievable with current commercial RF constellations over most conflict latitudes. Near-real-time alerting (sub-six-hour latency from collection to delivery) is technically feasible but depends on ground station downlink scheduling and processing pipeline configuration, which varies by provider.
Typical figures
| Frequency coverage | 700 MHz to 6 GHz (Spire STRATOS); 144 MHz to 15 GHz (HawkEye 360 published range). Covers GSM 900/1800, all major LTE bands and sub-6 GHz 5G NR. |
| Geolocation accuracy (open terrain) | Low hundreds of metres (HawkEye 360 published figures using TDOA/FDOA across three-satellite cluster) |
| Geolocation accuracy (dense urban) | Degrades to 1 km or more due to multipath; treat as district-level indicator without corroboration |
| Minimum detectable emitter | Macro base stations at approximately 43 dBm EIRP class detectable from 400–600 km LEO; small cells at 23–30 dBm EIRP generally below detection floor |
| Revisit / pass frequency | Multiple passes per day over most latitudes with Spire constellation (100-plus satellites); HawkEye revisit varies by tasking priority and orbital geometry |
| Detection latency | Sub-six-hour from collection to processed output is feasible; depends on ground station downlink scheduling |
| Weather / cloud sensitivity | None. RF collection is unaffected by cloud, smoke, precipitation or darkness. |
| Reference frequency database | ITU BR IFIC (International Frequency Information Circular) for licensed assignment cross-referencing |
| Archive depth | HawkEye 360 commercial archive from approximately 2019; Spire STRATOS from approximately 2020. Coverage density varies by region and collection tasking history. |
Analytics Satellize can run
| Base station operational status map | Time-series aggregation of per-pass detection events; active/inactive classification by detection frequency threshold across rolling window | GIS layer (GeoJSON or shapefile) updated daily or weekly, showing active, inactive and uncertain-status sites with confidence score |
| Infrastructure destruction or outage event report | Change detection on RF time series; corroboration with optical or SAR imagery for physical confirmation | Event report with timestamp, location, frequency band affected, and corroborating imagery reference |
| Anomalous emitter alert | Cross-reference of detected frequencies against ITU BR IFIC licensed assignments; flagging of emissions outside licensed parameters for the territory | Alert feed (JSON or email) with frequency, estimated location, deviation from licensed assignment, and confidence band |
| Mobile or deployable base station tracking | Location-change detection for emissions at operator-assigned frequencies appearing at sites with no prior detection history; temporal clustering to distinguish new deployments from geolocation scatter | Annotated track log showing first-detection date, successive position estimates and frequency metadata |
| Network coverage survivability assessment | Aggregation of active site detections into estimated coverage footprint using published base station propagation models; comparison against pre-conflict baseline | Coverage comparison map showing estimated population or area with residual cellular access, delivered as PDF report with underlying GIS data |
| Operator-level activity attribution | Frequency-to-operator mapping via ITU IFIC and publicly available national spectrum allocation tables; disambiguation of co-channel emitters using TDOA cluster analysis | Operator-attributed activity table showing which licensed carriers remain operational by district and time period |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.