8.6.3 — Infrastructure Threat Monitoring — maturity: live
Communications Infrastructure Watch
Persistent satellite surveillance of terrestrial communications infrastructure — towers, cable landing stations, exchange buildings — to detect physical intrusion, sabotage, or covert equipment installation.
When a nation's cellular towers, undersea cables, and terrestrial relay networks go dark, the cascade can cripple emergency response, financial systems, and military command within hours — persistent orbital watch is the only sensor layer that survives the outage itself.
A nation's communications backbone — mobile towers, submarine cable landing points, internet exchange buildings, microwave relay chains — is both the nervous system of the economy and a high-value target for state and non-state adversaries. Ground patrols and perimeter cameras cover individual sites, but no terrestrial system can deliver simultaneous, unannounced observation across hundreds of dispersed facilities. The result is a blind spot that a sophisticated adversary can exploit for weeks before an incident is even reported.
A sovereign constellation closes that blind spot by combining sub-metre optical imagery with synthetic aperture radar (SAR) and RF signal survey. Optical and SAR passes detect physical changes — new vehicles at a cable landing station, unplanned civil works near a fibre route, ground disturbance around a mast base — without relying on site staff to report anomalies. RF survey payloads identify rogue transmitters co-located on licensed towers, a known tactic for covert spectrum interception. Change-detection algorithms compare passes against a registered baseline, flagging deviations for human review within hours of acquisition.
The operational outcome is an always-on, geographically comprehensive audit of physical infrastructure integrity. Security agencies receive cueed alerts rather than sifting raw imagery; telecoms regulators gain independent evidence for enforcement actions; and military planners hold a current picture of which nodes remain intact during a crisis. Because the data never leaves national systems, threat intelligence derived from anomaly patterns cannot be accessed by a foreign vendor or disclosed under another jurisdiction's legal process.
Frequently asked
What exactly can a satellite detect about communications infrastructure threats — can it see an attack in progress?
Satellites detect proxies and signatures rather than the act itself. Optical and SAR imagery reveals physical damage, abnormal vehicle presence, excavation near cable corridors, or structural changes to tower pads. RF-monitoring payloads detect unexpected spectrum silencing, jamming signals, or rogue transmitters. Thermal IR can flag overheating equipment at base stations. Fused together, these signatures allow operators to characterise an evolving threat with high confidence — but a sub-30-minute attack will almost certainly be detected in its aftermath rather than prevented by the satellite layer alone.
Why can't we just buy this as a service from Planet, ICEYE, or HawkEye 360?
Commercial tasking is subordinate to the vendor's broader customer queue and their government's export-control regime. In a genuine national security event — exactly when communications infrastructure is under attack — a foreign commercial vendor can be compelled to suspend service, reprioritise assets, or withhold processed data under its home-nation laws. Sovereign ownership removes that single point of political failure. It also means the nation retains raw data custody, controls classification, and can surge tasking without competing against other paying customers.
What orbit and how many satellites does a credible sovereign constellation require?
For most nations, a LEO constellation between 450 and 600 km altitude provides the best tradeoff of revisit, ground resolution, and drag-assisted disposal at end-of-life. A minimum viable constellation for sub-3-hour national revisit over a medium-sized country (approximately 500,000–2,000,000 km²) is typically 6–12 microsatellites in complementary orbital planes. Combining optical, SAR, and RF payloads on separate buses — or multi-payload microsats — gives the spectral diversity needed to defeat cloud cover and RF ambiguity. Nations with large EEZs or lengthy land borders should plan for 18–30 satellites to cover maritime cable landing zones adequately.
How does this application relate to cybersecurity of communications infrastructure?
Space-based infrastructure watch addresses the physical and electromagnetic layer — it cannot detect software-based intrusions into router firmware or BGP hijacking. It is best understood as the physical security complement to a national cyber operations centre. When cyber defenders observe an anomaly in network traffic and suspect physical sabotage, the satellite layer provides immediate geospatial confirmation or exclusion, dramatically accelerating incident response. The NIST SP 800-82 Rev. 3 framework explicitly recommends integrating geospatial situational awareness into OT security postures.
What data rights and classification issues arise when a government operates this kind of system?
Sovereign operation means the government classifies and controls all raw imagery and derived intelligence. This is an advantage for national security but creates interoperability friction when sharing alerts with allied nations, infrastructure operators, or international bodies like ITU or ICPC. Nations should design tiered data-sharing architectures from the outset — producing unclassified derived products (damage polygons, anomaly alerts) alongside classified raw imagery — so that commercial operators and international partners can act on alerts without requiring full access to the sovereign sensor data.
Are there international legal constraints on monitoring another country's communications infrastructure from space?
The Outer Space Treaty (1967) Article I affirms freedom of observation from orbit, and no binding international norm prohibits passive EO or RF monitoring of foreign territory from space. However, active interference with a foreign satellite or terrestrial communication system would violate Article IX and potentially ITU Radio Regulations. Nations conducting space-based RF anomaly detection near international borders should obtain legal opinions on whether passive collection triggers any bilateral intelligence-sharing or non-interference treaty obligations.
How do we handle the ground segment if the communications infrastructure we are monitoring is itself degraded?
This is the critical resilience design problem. The recommended architecture is a distributed ground-station network with at least one node physically separated from the primary national communications backbone — ideally connected via an independent fibre path or satellite backhaul through a different constellation. Inter-satellite links (ISLs) allow satellites to relay data peer-to-peer to a ground station still in contact, bypassing a compromised downlink site. Nations should treat the ground segment as equally critical as the space segment and apply the same physical security standards.
What is the expected build-and-launch timeline and cost for a sovereign constellation at this scale?
A 12-satellite microsatellite constellation with mixed optical and SAR payloads, procured through a national prime contractor working with commercial smallsat bus suppliers, typically runs 36–54 months from contract award to initial operational capability and costs in the range of $180M–$350M depending on ground-segment scope and domestic industrial content requirements. Nations that mandate significant in-country manufacturing add 15–25% to cost but gain long-term industrial sovereignty. Subsequent constellation replenishment costs drop significantly once the supply chain is established domestically.