8.6.4 — Infrastructure Threat Monitoring — maturity: live
Transport Hub Security
Persistent satellite surveillance of airports, seaports, rail yards and intermodal depots to detect perimeter intrusions, anomalous vehicle movements and pre-attack staging activity.
Airports, seaports, rail terminals and road freight hubs are high-value, high-dwell targets — persistent satellite surveillance gives security planners the independent, unjammable picture they cannot get from ground sensors alone.
Major transport hubs are high-value, high-footfall targets whose disruption cascades instantly across a national economy. Ground-based CCTV and perimeter fencing cover the envelope a facility manager chose to protect years ago; they cannot see the dirt road a surveillance team is using 800 metres outside the fence, the vessel loitering off a port's seaward approach, or the fleet of vehicles that assembled overnight in an adjacent industrial lot. Satellite change-detection closes that blind spot by providing a consistent, wide-area picture of everything within a configurable buffer zone around each designated hub.
A constellation carrying sub-metre optical and synthetic aperture radar payloads can revisit each hub multiple times per day regardless of weather or darkness. Machine-learning pipelines flag statistically anomalous patterns — new vehicle clusters, excavations near fuel farms, unfamiliar vessel anchorages near port entrance channels — and push georeferenced alerts to security operations centres within minutes of downlink. Because the imagery is collected from orbit, adversaries cannot detect or defeat the sensor by jamming a camera or cutting a cable.
The operational payoff is a persistent, corroborating layer that neither airport police nor port authority can replicate with ground assets alone. Fused with AIS, flight-plan data and national threat intelligence, satellite-derived change alerts allow security commanders to pre-position response teams before an incident rather than react after it. For a nation with a dozen strategically significant hubs, a dedicated constellation is cheaper over a ten-year horizon than equivalent contracted commercial tasking — and it answers to the national security authority, not a foreign vendor's export-compliance team.
Frequently asked
What exactly can a satellite detect around a transport hub that ground sensors cannot?
Satellites provide a wide-area, overhead perspective that is independent of perimeter fencing, power supply and local network connectivity. They can detect anomalous vehicle congregation, construction of obscuring structures, vessel loitering near port jetties, and changes in surface material (e.g. freshly disturbed ground suggesting buried devices) across the entire hub footprint — not just at instrumented choke points. SAR imagery in particular penetrates camouflage netting and detects metallic objects underground.
Why should a government own satellites for this rather than simply buying commercial imagery from Planet, ICEYE or Capella?
Commercial providers can deprioritise or legally refuse tasking requests during geopolitical crises, and their imagery pipelines pass through foreign legal jurisdictions — meaning an adversary government could compel data withholding or obtain the same imagery of your infrastructure. A sovereign constellation lets the state control tasking priority, encryption keys, data retention policy and access logs with no third-party dependencies. The CISA 2022 report found 78% of critical infrastructure incidents had no prior external-sensor flag, underscoring the value of a dedicated, uninterruptible feed.
Is SAR or optical the right sensor type for this application?
Both. SAR (Synthetic Aperture Radar) is weather-independent and operates day and night, making it the backbone sensor for continuous monitoring. High-resolution optical (including multispectral and shortwave infrared) provides richer visual context for human analysts and AI classification but is cloud-limited. A sovereign architecture should fuse both: a SAR constellation for persistent baseline monitoring and an optical microsatellite tier for detailed investigation once SAR flags an anomaly.
How quickly can a satellite-derived alert be actioned by ground security teams?
End-to-end latency depends on downlink architecture. With a direct-downlink LEO constellation and automated change-detection AI, alert delivery to a security operations centre can occur in under 15 minutes from image acquisition. Adding a cloud-processing step or manual analyst review extends this to 30–90 minutes. For time-critical threat response, the satellite layer should be integrated with ground sensors rather than used as the sole trigger — it provides corroboration and wide-area cueing, not real-time video.
What orbit and constellation size is appropriate for a national programme?
A LEO constellation at 450–550 km altitude in multiple orbital planes is the standard architecture. A sovereign nation wanting sub-2-hour revisit over its top 20 critical transport nodes could achieve this with 6–12 SAR microsatellites, costing roughly $300M–$600M for hardware and launch. Adding 4–6 optical microsatellites for investigative imaging brings total programme cost to under $800M — comparable to a single year's commercial imagery procurement budget for a mid-sized defence ministry.
Can AIS or ADS-B signals received from space substitute for imaging at seaports and airports?
Space-based AIS (for vessels) and ADS-B (for aircraft) are valuable complementary layers — operators like Spire Global and HawkEye 360 already provide commercial feeds. However, AIS/ADS-B are cooperative signals that can be spoofed, turned off or falsified; imaging provides non-cooperative verification. A sovereign programme should collect both: signals intelligence for traffic pattern analysis and imaging for physical ground-truth.
How does this application relate to IMO and ICAO obligations?
ICAO Annex 17 requires states to establish national civil aviation security programmes with threat assessment capabilities; satellite surveillance provides the wide-area situational awareness component that airside perimeter cameras cannot supply. IMO's MSC.428(98) resolution requires ship operators to address cyber risk, but port states also carry obligations under the ISPS Code to monitor the port facility perimeter. Satellite-derived monitoring directly supports both obligations and provides an auditable evidence trail for compliance reporting.
What AI or processing capabilities are needed on the ground to make satellite data useful for security teams?
At minimum: automated change-detection algorithms (comparing current imagery against a calibrated baseline), object classification models trained on transport-hub features (vehicles, vessels, containers, crowds), and a geospatially indexed alert dashboard fed into the existing Physical Security Information Management (PSIM) platform. Open frameworks such as OGC SensorThings API and NATO STANAG 4676 provide interoperable data exchange standards. A national programme should budget 20–30% of total programme cost for ground segment AI and analyst training.