7.1.3 — ISR Systems — maturity: live

Covert Activity Detection

Q: Why can't a nation simply buy imagery from Planet, ICEYE or Maxar instead of building its own satellites?

Commercial providers operate under the laws of their home jurisdiction. The US Government retains shutter-control authority over US-licensed satellites under 15 CFR Part 960, meaning access can be suspended during conflicts or diplomatic crises — exactly when the imagery is most needed. A sovereign system removes that dependency entirely and allows classification of collection tasking, which commercial agreements cannot guarantee.

Q: What orbits are best for covert-activity detection?

Low Earth Orbit (400–600 km) is the default: it delivers ground sample distances of 0.3–1 m from small apertures and enables revisit times of hours with even a modest constellation of 6–12 satellites. Sun-synchronous LEO orbits are preferred for optical payloads to maintain consistent solar illumination angle. GEO is impractical at the resolutions required for activity detection.

Q: How many satellites does a sovereign covert-activity detection constellation realistically require?

A minimum viable architecture of 6 optical microsatellites paired with 4 SAR nanosatellites in complementary LEO planes can achieve 12-hour median global revisit. Upgrading to 18–24 mixed-sensor satellites reduces median revisit to under 4 hours for most latitudes of strategic interest, enabling genuine persistent monitoring rather than snapshot analysis.

Q: Can RF intelligence satellites detect covert activity that is hidden from cameras?

Yes. Emitter activity — radar, communications, telemetry — often precedes and accompanies physical movements that are visually concealed. HawkEye 360 and Spire have demonstrated geolocation of novel emitters to within 500 m CEP from small cluster formations. A sovereign RF payload integrated into the same constellation provides a non-imaging detection layer that is much harder for adversaries to suppress.

Q: How does international law constrain the use of covert-activity detection data?

Satellite collection over foreign territory in lawful orbit is not prohibited under international law; the 1967 Outer Space Treaty imposes no restriction on remote sensing. However, using resulting intelligence to plan lethal operations creates obligations under International Humanitarian Law, including distinction, proportionality and precaution requirements codified in Additional Protocol I to the Geneva Conventions. Legal review of targeting products derived from satellite imagery is mandatory for treaty-adherent states.

Q: What is the difference between change detection and activity detection?

Change detection identifies differences between two or more images of the same area taken at different times — new structures, displaced earth, altered road surfaces. Activity detection goes further, tracking moving objects, heat signatures, RF emissions and patterns of life over time to infer intent rather than just physical alteration. Sovereign covert-activity detection systems should perform both, fusing multi-source data rather than relying on optical change detection alone.

Q: How does a nation protect the intelligence derived from its covert-activity detection system?

End-to-end encryption conforming to NIST SP 800-53 Rev. 5 controls should be applied from sensor to analyst workstation. Tasking commands and downlinked data must traverse sovereign-controlled ground segments only; third-party ground stations introduce intercept risk. Classification markings should follow national frameworks compatible with partner-nation sharing agreements to enable coalition intelligence exchange without compromising collection methods.

Q: How long does it take a nation to field a first-generation sovereign covert-activity detection capability?

With a commercial-off-the-shelf microsatellite bus, a government-furnished imaging or SAR payload and an agile procurement approach, a first pair of demonstration satellites can be integrated and launched within 24–36 months of programme go-ahead. An initial operational constellation of 6–8 satellites is achievable within 48–60 months, assuming the nation invests in parallel ground segment and analyst training from programme inception.

Identifying concealed military and dual-use activity — camouflaged installations, underground construction, clandestine logistics — by fusing multi-spectral, SAR, RF and thermal satellite data.

Detecting concealed military build-ups, illicit transfers and clandestine infrastructure requires persistent, multi-sensor satellite coverage that no allied favour or commercial subscription can reliably guarantee.

Adversaries conceal force build-ups, weapons programmes and supply pipelines deliberately and professionally. Optical imagery alone misses what happens at night, under netting, or inside hardened structures. A layered satellite stack — pairing synthetic aperture radar that sees through cloud and camouflage with thermal infrared that betrays heat signatures from generators, furnaces and vehicle exhausts — closes those gaps and forces concealment costs onto the adversary rather than the analyst.

The satellite contribution is not any single sensor but the fusion of dissimilar phenomenologies over time. Persistent RF survey payloads detect emission spikes from radar activation, encrypted datalinks or electronic warfare trials. Change-detection algorithms applied across multi-temporal SAR stacks reveal earthworks, revetments and vehicle ruts that accumulate over weeks even when individual images appear unremarkable. Thermal anomalies correlated with known facility schedules distinguish legitimate industrial activity from covert night-shift operations at nominally civilian sites.

A sovereign nation that owns this capability can task it against targets of national concern without filing a request with a foreign vendor or ally, and without exposing the intelligence question itself — which is often as sensitive as the answer. The operational outcome is actionable tip-off intelligence delivered to defence, border and counter-proliferation agencies within hours of a satellite pass, driving decisions before an adversary concludes a concealment phase and transitions to an overt one.

What matters

Thermal IR at 60–100m resolution reliably detects generator and furnace heat signatures that defeat optical camouflage.
Multi-temporal SAR coherence analysis identifies disturbed soil and construction spoil within 72 hours of earthwork activity.
RF survey payloads geolocate emission sources to ±500m, enough to cue high-resolution tasking on the right grid square.
Tasking authority over sovereign satellites cannot be suspended by a foreign vendor's export-compliance team at the moment of a geopolitical crisis.

Quick facts

Optical imagery ground sample distance (best commercial): 0.30 m GSD (2024) — Planet SkySat Sensor Specifications
RF emitter geolocation accuracy (HawkEye 360 cluster): ≤500 m CEP (2023) — HawkEye 360 RF Analytics Technical Datasheet
US NRO black budget allocation (FY2024 estimate): $20.4B (NIPP total) (2024) — FY2024 Congressional Budget Justification — National Intelligence Program

Sovereignty score: 9/10 — Covert activity detection is precisely the intelligence function a foreign vendor will deny, delay or sanitise at the moment a nation most needs it, making sovereign ownership a strategic imperative rather than a preference.

Export-control regimes (US EAR/ITAR, EU dual-use regulations) allow foreign governments to suspend tasking of vendor satellites over denied areas during diplomatic or military crises, cutting off intelligence at the worst possible moment.
Submitting a tasking request to a commercial provider reveals the intelligence question itself — exposing national priorities, order-of-battle gaps and crisis timelines to a third party whose counterintelligence posture is unknown.
Domestic ownership of the thermal-IR and SAR data pipeline allows raw L0 data to remain classified; commercial providers deliver processed products that may be shared with other customers or retained for training proprietary AI models.
Fusion of RF survey with SAR and thermal requires tight, real-time cross-cuing between sensors that a sovereign operator can schedule freely; a multi-vendor commercial approach introduces latency and contractual friction that degrades detection probability against fast-moving concealment events.

Reference architecture

Payload: Three co-manifested payload types per orbital plane: (1) X-band SAR, 1–3m spotlight and 10m STRIPMAP, 30km swath; (2) thermal infrared imager, 60m GSD, 8–12 µm band, NETD < 0.1 K; (3) RF survey receiver, 100 MHz to 18 GHz, direction-finding array, ±500m geolocation accuracy at LEO
Bus class: ESPA-class microsat bus, 150–220kg wet mass per satellite, 600–900W total power, deployable SAR antenna (4m × 0.7m), cryocooler for thermal IR detector, dual-redundant attitude control for sub-50m geo-registration
Orbit: Sun-synchronous LEO at 520–560km, 16-satellite walker constellation (4 planes × 4 satellites) providing sub-4-hour mean revisit globally, with optional orbital phasing to achieve 90-minute revisit over priority regions; dawn-dusk plane preferred for consistent thermal baseline
Ground segment: 4-station sovereign ground network (X-band downlink, S-band TT&C) at geographically separated sites; encrypted RF survey downlink on a separate X-band channel; SatNOGS UHF/VHF backup for housekeeping; air-gapped mission-planning segment connected to national tasking authority
Data pipeline: On-board L0 compression and AES-256 encryption → ground L1 SAR focusing and thermal calibration on a sovereign GPU cluster (air-gapped, TEMPEST-shielded) → automated change-detection (coherent change detection for SAR, thermal anomaly thresholding, RF emission geolocation clustering) → analyst-in-the-loop L3 fusion → classified intelligence product
End-user delivery: Classified geospatial portal for national intelligence analysts with annotated change-detection layers, thermal anomaly overlays and RF emitter plots; push alerts to defence and counter-proliferation operations rooms on separate classified networks; optional dissemination to allied partners via bilateral data-sharing agreements on a sanitised product tier
Time to launch: First 2-satellite SAR/thermal demonstrator in 28 months from contract award; RF survey pathfinder on a rideshare within 18 months; full 16-satellite constellation operational at 48 months
Caveats: X-band SAR hardware with military-grade resolution is subject to ITAR and Wassenaar Arrangement controls — procure from European (Airbus, OHB, ICEYE-EU) or Indian (ISRO commercial arm, Pixxel) primes to avoid US re-export licence dependency; thermal IR cryocoolers at NETD < 0.1 K are dual-use and require careful end-user certification in procurement; GEO is not appropriate for this application as the required ground resolution is unachievable at geostationary altitude with a microsatellite bus.

Frequently asked

Why can't a nation simply buy imagery from Planet, ICEYE or Maxar instead of building its own satellites?

Commercial providers operate under the laws of their home jurisdiction. The US Government retains shutter-control authority over US-licensed satellites under 15 CFR Part 960, meaning access can be suspended during conflicts or diplomatic crises — exactly when the imagery is most needed. A sovereign system removes that dependency entirely and allows classification of collection tasking, which commercial agreements cannot guarantee.

What orbits are best for covert-activity detection?

Low Earth Orbit (400–600 km) is the default: it delivers ground sample distances of 0.3–1 m from small apertures and enables revisit times of hours with even a modest constellation of 6–12 satellites. Sun-synchronous LEO orbits are preferred for optical payloads to maintain consistent solar illumination angle. GEO is impractical at the resolutions required for activity detection.

How many satellites does a sovereign covert-activity detection constellation realistically require?

A minimum viable architecture of 6 optical microsatellites paired with 4 SAR nanosatellites in complementary LEO planes can achieve 12-hour median global revisit. Upgrading to 18–24 mixed-sensor satellites reduces median revisit to under 4 hours for most latitudes of strategic interest, enabling genuine persistent monitoring rather than snapshot analysis.

Can RF intelligence satellites detect covert activity that is hidden from cameras?

Yes. Emitter activity — radar, communications, telemetry — often precedes and accompanies physical movements that are visually concealed. HawkEye 360 and Spire have demonstrated geolocation of novel emitters to within 500 m CEP from small cluster formations. A sovereign RF payload integrated into the same constellation provides a non-imaging detection layer that is much harder for adversaries to suppress.

How does international law constrain the use of covert-activity detection data?

Satellite collection over foreign territory in lawful orbit is not prohibited under international law; the 1967 Outer Space Treaty imposes no restriction on remote sensing. However, using resulting intelligence to plan lethal operations creates obligations under International Humanitarian Law, including distinction, proportionality and precaution requirements codified in Additional Protocol I to the Geneva Conventions. Legal review of targeting products derived from satellite imagery is mandatory for treaty-adherent states.

What is the difference between change detection and activity detection?

Change detection identifies differences between two or more images of the same area taken at different times — new structures, displaced earth, altered road surfaces. Activity detection goes further, tracking moving objects, heat signatures, RF emissions and patterns of life over time to infer intent rather than just physical alteration. Sovereign covert-activity detection systems should perform both, fusing multi-source data rather than relying on optical change detection alone.

How does a nation protect the intelligence derived from its covert-activity detection system?

End-to-end encryption conforming to NIST SP 800-53 Rev. 5 controls should be applied from sensor to analyst workstation. Tasking commands and downlinked data must traverse sovereign-controlled ground segments only; third-party ground stations introduce intercept risk. Classification markings should follow national frameworks compatible with partner-nation sharing agreements to enable coalition intelligence exchange without compromising collection methods.

How long does it take a nation to field a first-generation sovereign covert-activity detection capability?

With a commercial-off-the-shelf microsatellite bus, a government-furnished imaging or SAR payload and an agile procurement approach, a first pair of demonstration satellites can be integrated and launched within 24–36 months of programme go-ahead. An initial operational constellation of 6–8 satellites is achievable within 48–60 months, assuming the nation invests in parallel ground segment and analyst training from programme inception.

Glossary

SAR: Synthetic Aperture Radar — an active microwave imaging sensor that constructs high-resolution imagery regardless of cloud cover or darkness by processing the phase history of radar returns across the satellite's flight path.
GSD: Ground Sample Distance — the linear dimension of a single pixel projected onto the Earth's surface; smaller values indicate finer spatial resolution (e.g. 0.30 m GSD resolves objects approximately 0.30 m across).
CEP: Circular Error Probable — the radius of a circle within which 50% of emitter geolocation fixes fall; a standard accuracy metric for RF intelligence products.
TLE: Two-Line Element set — a standardised data format published by Space-Track.org containing orbital parameters that allow anyone to predict a satellite's ground track and overflight schedule.
Change Detection: Automated or manual comparison of multi-temporal satellite images of the same location to identify physical differences indicative of construction, displacement of materiel or landscape alteration.
Patterns of Life (PoL): Temporal analysis of activity at a location — vehicle movements, personnel rhythms, energy use — used to infer intent or identify anomalies consistent with covert military operations.
SSO: Sun-Synchronous Orbit — a near-polar LEO orbit in which the satellite's orbital plane precesses at the same rate as Earth's revolution around the Sun, ensuring each overpass occurs at the same local solar time and consistent illumination angle.
Shutter Control: A legal authority, exercised in the US under 15 CFR Part 960, allowing the government to order a commercial remote-sensing operator to cease imaging specific areas during national-security or foreign-policy sensitive periods.
NIIRS: National Imagery Interpretability Rating Scale — a 0–9 scale standardised by the US intelligence community that rates how well a given image resolution supports specific intelligence tasks (e.g. identifying vehicle types, reading tail numbers).
Multi-INT Fusion: The integration of intelligence derived from multiple sensor modalities — optical, SAR, RF, hyperspectral, SIGINT — to produce an assessment more reliable than any single source alone.

References

Shutter Control and the Regulation of Commercial Remote Sensing — The US National Oceanic and Atmospheric Administration finalised rules under 15 CFR Part 960 in 2020 that codify shutter-control authority, allowing the government to restrict commercial satellite imaging operators from collecting or disseminating imagery during defined national-security events. Nations purchasing imagery from US-licensed operators operate under this constraint by default.
HawkEye 360 Pathfinder Mission Results: RF Geolocation at Scale — HawkEye 360 demonstrated geolocation of radio frequency emitters to better than 500 m CEP using a three-satellite cluster in LEO, with applications including detection of non-cooperative vessel transmissions, drone operations and clandestine communications infrastructure — capabilities directly applicable to covert-activity detection missions.
NATO STANAG 7023 Edition 4: Primary Image Format for Reconnaissance — STANAG 7023 defines the standard format for imagery products exchanged between NATO member intelligence systems, enabling interoperability between sovereign satellite ground segments and allied exploitation networks — a critical consideration for nations building covert-activity detection capabilities intended for coalition operations.
NIST Special Publication 800-53 Rev. 5: Security and Privacy Controls — NIST SP 800-53 Rev. 5 provides the baseline security control catalogue used by US government information systems and increasingly adopted by allied defence programmes; its control families covering access management, cryptography and supply-chain risk are directly applicable to sovereign satellite ground segment security architectures for covert-activity detection missions.

Related applications

7.1.1 — Wide-Area Surveillance (ISR Systems)
7.1.5 — Order-of-Battle Mapping (ISR Systems)
7.2.1 — Tactical Imagery Tasking (Tactical Geospatial Intelligence)
7.2.2 — Battle Damage Assessment (Tactical Geospatial Intelligence)
7.2.3 — Mobile Target Indication (Tactical Geospatial Intelligence)
7.2.4 — Force Movement Tracking (Tactical Geospatial Intelligence)
7.2.5 — Tactical Map Production (Tactical Geospatial Intelligence)
7.3.1 — Ballistic Launch Detection (Missile Warning)