Sensors
- HawkEye 360 cluster constellation: Three-satellite formation flying at roughly 575 km altitude, with intra-cluster baselines of tens of kilometres, enabling TDOA and FDOA geolocation of L-band and S-band emitters. Published geolocation accuracy is cited by HawkEye 360 as approximately 500 m to a few kilometres depending on signal duration and geometry. Revisit varies by latitude; equatorial revisit is several hours per cluster pass.
- Spire STRATOS RF payload: Hosted on Spire's 3U CubeSat constellation (100-plus satellites, roughly 500–550 km altitude). STRATOS is designed for passive RF collection across VHF to S-band. Single-satellite Doppler-only geolocation is possible for longer transmissions; multi-satellite TDOA requires near-simultaneous collection. Revisit is sub-hourly at mid-to-high latitudes.
- Iridium NEXT hosted payload capacity: The Iridium NEXT constellation (66 operational satellites, 780 km altitude, near-polar orbit) carries hosted payload slots. Because Iridium handsets uplink at 1616–1626.5 MHz directly to the constellation, a hosted receiver on an adjacent or cross-link satellite is geometrically well-placed to intercept the uplink signal with known satellite ephemeris. No public commercial service currently exploits this for geolocation, but the link-budget physics are well documented.
- Thuraya and Globalstar link geometry (reference only): Thuraya operates at GEO (L-band, 1525–1559 MHz uplink) so LEO intercept geometry differs: a LEO interceptor sees a Doppler shift dominated by its own motion relative to the Thuraya uplink beam rather than the handset-to-GEO path. Globalstar uses a bent-pipe architecture at 1610–1618.725 MHz (uplink), making LEO intercept of the handset uplink feasible on the same Doppler-curve principles as Iridium, though Globalstar's lower satellite altitude (1414 km) changes the link budget slightly.
Why a moving receiver is the measurement
Ground-based direction-finding requires multiple fixed antennas or a rotating aperture to triangulate a transmitter. A LEO satellite removes that requirement by moving itself. At 7–8 km/s relative to the Earth's surface, a satellite intercept platform crosses from horizon to horizon in roughly ten minutes, during which the received frequency of a stationary emitter sweeps through a characteristic S-shaped Doppler curve. The inflection point of that curve occurs at the moment of closest approach, and the slope on either side encodes the geometry of the pass relative to the emitter.
Fitting the observed Doppler time-series to a model of satellite motion constrains the emitter to a ground ellipse, the locus of all surface points consistent with the measured curve. A single satellite pass typically produces a position uncertainty of several kilometres along the major axis of that ellipse. Adding a second satellite, or a second pass, intersects two ellipses and collapses the ambiguity substantially. This is the published operating principle behind HawkEye 360's cluster architecture, where three satellites in close formation collect simultaneous time-difference-of-arrival (TDOA) and frequency-difference-of-arrival (FDOA) measurements.
What the L-band and S-band physics allow
Iridium handsets transmit at 1616–1626.5 MHz (L-band) with a typical uplink EIRP of around 7 dBW. Globalstar handsets uplink at 1610–1618.725 MHz. These are narrowband TDMA or CDMA signals with burst durations ranging from tens of milliseconds to a few seconds per frame. The short burst is the central practical problem: Doppler-curve fitting requires enough signal duration to resolve the frequency-time slope. A 100 ms burst at 1.6 GHz, with a satellite moving at 7.5 km/s, produces a Doppler shift rate of roughly 40–80 Hz/s near closest approach, depending on geometry. That is detectable with a stable reference oscillator, but the curve is sampled at only a few points, which degrades position accuracy.
Longer transmissions, voice calls rather than short data bursts, give the intercept receiver more of the Doppler arc and tighten the position estimate. Encrypted traffic does not defeat the method: geolocation exploits the carrier frequency and timing envelope, not the content. This is an important distinction for intelligence and regulatory applications alike.
The symmetric ambiguity problem
A single Doppler curve is geometrically ambiguous. The same curve is produced by an emitter north of the ground track and one symmetrically placed to the south. This is not a minor caveat; it halves the information content of a single-pass measurement. Resolving the ambiguity requires either a second pass on a different ground track, a second satellite with a different viewing geometry collected simultaneously, or prior knowledge that constrains which solution is physically plausible (coastline, known operating area, previous fix).
HawkEye 360's published approach uses TDOA between cluster satellites to break this symmetry in a single pass. The baseline between satellites in the cluster is typically tens of kilometres, giving a TDOA measurement with nanosecond-class precision that, combined with FDOA, produces a two-dimensional position fix without the ambiguity. Even so, the published accuracy figures of roughly 500 m to a few kilometres reflect real residual uncertainty from satellite ephemeris error, ionospheric delay variation, and the finite signal duration. Buyers should treat sub-kilometre accuracy as a best-case figure for long, clean signals and assume multi-kilometre uncertainty for short bursts or poor geometry.
Revisit, latency and the coverage gap at low latitudes
Coverage is uneven. LEO constellations designed for RF geolocation accumulate more passes per day at high latitudes because orbital mechanics concentrate ground tracks toward the poles. A target at 70° N might be overflown by a HawkEye 360 cluster several times in a twelve-hour window; a target near the equator may wait four to six hours between useful passes. Spire's larger constellation partially compensates for this with higher satellite count, but simultaneous multi-satellite collection for TDOA is less guaranteed.
Latency from signal intercept to delivered geolocation fix depends on downlink scheduling and processing pipeline. Operationally, figures of thirty minutes to a few hours are realistic for current commercial services, though near-real-time pipelines processing direct downlinks from satellites with inter-satellite links can reduce this. For time-sensitive applications, latency is often the binding constraint, not spatial accuracy.
Honest limits and what the method cannot do
Several limits deserve plain statement. First, the method requires the handset to be transmitting. A phone in standby, or one with its uplink disabled, produces no signal to intercept. Second, frequency-hopping or spread-spectrum waveforms reduce the coherent integration time available for Doppler measurement, degrading accuracy. Third, urban multipath or terrain masking can distort the received signal in ways that bias the position estimate without obvious flags in the data. Fourth, the method geolocates the antenna, not necessarily the person: a handset on a vessel, vehicle or relay node places the fix at the platform, not the individual.
Finally, regulatory and legal frameworks governing passive interception of commercial satellite phone signals vary substantially by jurisdiction. This page describes the physics and the published technical capability; the lawful use of that capability is a matter for the operating entity and its legal counsel.
From raw fix to actionable intelligence
A single geolocation fix has limited value in isolation. The analytical work is in the pattern: repeated fixes from the same handset identifier (or the same RF fingerprint, where the transmitter has a measurable frequency offset or modulation characteristic) build a track. Tracks reveal movement, dwell time and associations with other emitters or platforms. Correlating satellite phone fix history with AIS vessel tracks, for instance, can associate a phone with a specific ship even when the phone's identity is unknown.
Satellize structures this kind of multi-source correlation work for government clients who need sovereign analytical capability rather than dependence on a single commercial data provider. The analytical pipeline for RF geolocation draws on the same orbit-mechanics and signal-processing methods published in the open literature on TDOA/FDOA geolocation, applied to licensed data streams from intercept constellations. Clients looking to scope a specific monitoring requirement should bring a defined area, a target signal type and a revisit requirement to the first technical conversation.
Typical figures
| Frequency coverage (typical intercept payloads) | VHF to S-band; L-band (1.6 GHz) and S-band (2–3 GHz) most relevant for satellite phone uplinks |
| Geolocation accuracy (TDOA+FDOA, cluster) | Approximately 500 m to a few kilometres depending on signal duration, geometry and ephemeris quality; multi-kilometre typical for short bursts |
| Single-satellite Doppler-only accuracy | Several to tens of kilometres; ambiguous without second pass or prior constraint |
| Minimum useful signal duration | Roughly 1–2 seconds for reliable Doppler-curve fitting; shorter bursts degrade accuracy significantly |
| Revisit (equatorial) | 4–6 hours typical for HawkEye 360 cluster; sub-hourly at high latitudes with larger constellations |
| Latency (intercept to delivered fix) | 30 minutes to a few hours for current commercial pipelines; faster with direct downlink architectures |
| Target signal types | Iridium (1616–1626.5 MHz uplink), Globalstar (1610–1618.725 MHz uplink), Thuraya L-band uplink; narrowband voice and data bursts |
| Symmetric ambiguity | Present in single-satellite Doppler-only collection; resolved by cluster TDOA or second-pass intersection |
| Archive depth (commercial RF intercept) | Varies by provider; HawkEye 360 has operated since 2018, providing multi-year historical collections for some regions |
Analytics Satellize can run
| Single-event geolocation fix | TDOA/FDOA inversion against known satellite ephemeris, published in open literature on passive emitter location | Point feature with uncertainty ellipse in GeoJSON or KML, timestamped to signal intercept |
| Handset movement track | Sequential fix association by RF fingerprint or network identifier across multiple passes | Timestamped track layer (GIS shapefile or GeoJSON) with dwell-time annotation |
| Emitter-to-vessel association | Spatial and temporal correlation of satellite phone fix history with AIS vessel position records | Association report linking phone fix cluster to named or unnamed vessel with confidence score |
| Area activity summary | Aggregation of fix density across a defined bounding box and time window, normalised by revisit coverage | Gridded heatmap (GeoTIFF) of satellite phone uplink activity, suitable for pattern-of-life analysis |
| Ambiguity-resolved position from multi-pass fusion | Intersection of Doppler ellipses from two or more passes on different ground tracks, weighted by estimated accuracy | Refined point fix with reduced uncertainty ellipse and pass-geometry metadata |
| Coverage and detectability assessment for a target area | Orbital mechanics simulation of intercept constellation passes over defined AOI, with link-budget estimate for target signal type | Pass schedule and probability-of-detection estimate delivered as a planning report ahead of operational tasking |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.