What exactly can a satellite detect about communications infrastructure threats — can it see an attack in progress?

Satellites detect proxies and signatures rather than the act itself. Optical and SAR imagery reveals physical damage, abnormal vehicle presence, excavation near cable corridors, or structural changes to tower pads. RF-monitoring payloads detect unexpected spectrum silencing, jamming signals, or rogue transmitters. Thermal IR can flag overheating equipment at base stations. Fused together, these signatures allow operators to characterise an evolving threat with high confidence — but a sub-30-minute attack will almost certainly be detected in its aftermath rather than prevented by the satellite layer alone.

Why can't we just buy this as a service from Planet, ICEYE, or HawkEye 360?

Commercial tasking is subordinate to the vendor's broader customer queue and their government's export-control regime. In a genuine national security event — exactly when communications infrastructure is under attack — a foreign commercial vendor can be compelled to suspend service, reprioritise assets, or withhold processed data under its home-nation laws. Sovereign ownership removes that single point of political failure. It also means the nation retains raw data custody, controls classification, and can surge tasking without competing against other paying customers.

What orbit and how many satellites does a credible sovereign constellation require?

For most nations, a LEO constellation between 450 and 600 km altitude provides the best tradeoff of revisit, ground resolution, and drag-assisted disposal at end-of-life. A minimum viable constellation for sub-3-hour national revisit over a medium-sized country (approximately 500,000–2,000,000 km²) is typically 6–12 microsatellites in complementary orbital planes. Combining optical, SAR, and RF payloads on separate buses — or multi-payload microsats — gives the spectral diversity needed to defeat cloud cover and RF ambiguity. Nations with large EEZs or lengthy land borders should plan for 18–30 satellites to cover maritime cable landing zones adequately.

How does this application relate to cybersecurity of communications infrastructure?

Space-based infrastructure watch addresses the physical and electromagnetic layer — it cannot detect software-based intrusions into router firmware or BGP hijacking. It is best understood as the physical security complement to a national cyber operations centre. When cyber defenders observe an anomaly in network traffic and suspect physical sabotage, the satellite layer provides immediate geospatial confirmation or exclusion, dramatically accelerating incident response. The NIST SP 800-82 Rev. 3 framework explicitly recommends integrating geospatial situational awareness into OT security postures.

What data rights and classification issues arise when a government operates this kind of system?

Sovereign operation means the government classifies and controls all raw imagery and derived intelligence. This is an advantage for national security but creates interoperability friction when sharing alerts with allied nations, infrastructure operators, or international bodies like ITU or ICPC. Nations should design tiered data-sharing architectures from the outset — producing unclassified derived products (damage polygons, anomaly alerts) alongside classified raw imagery — so that commercial operators and international partners can act on alerts without requiring full access to the sovereign sensor data.

Are there international legal constraints on monitoring another country's communications infrastructure from space?

The Outer Space Treaty (1967) Article I affirms freedom of observation from orbit, and no binding international norm prohibits passive EO or RF monitoring of foreign territory from space. However, active interference with a foreign satellite or terrestrial communication system would violate Article IX and potentially ITU Radio Regulations. Nations conducting space-based RF anomaly detection near international borders should obtain legal opinions on whether passive collection triggers any bilateral intelligence-sharing or non-interference treaty obligations.

How do we handle the ground segment if the communications infrastructure we are monitoring is itself degraded?

This is the critical resilience design problem. The recommended architecture is a distributed ground-station network with at least one node physically separated from the primary national communications backbone — ideally connected via an independent fibre path or satellite backhaul through a different constellation. Inter-satellite links (ISLs) allow satellites to relay data peer-to-peer to a ground station still in contact, bypassing a compromised downlink site. Nations should treat the ground segment as equally critical as the space segment and apply the same physical security standards.

What is the expected build-and-launch timeline and cost for a sovereign constellation at this scale?

A 12-satellite microsatellite constellation with mixed optical and SAR payloads, procured through a national prime contractor working with commercial smallsat bus suppliers, typically runs 36–54 months from contract award to initial operational capability and costs in the range of $180M–$350M depending on ground-segment scope and domestic industrial content requirements. Nations that mandate significant in-country manufacturing add 15–25% to cost but gain long-term industrial sovereignty. Subsequent constellation replenishment costs drop significantly once the supply chain is established domestically.

8.6.3Live

Communications Infrastructure Watch

Worker in safety harness inspecting a tall telecommunications mast in a rural landscape — Cell tower rising above the tree line relies on satellite monitoring to ensure uninterrupted connectivity for communities below.

Satellite Watch Over Communications Infrastructure

1
Observation Satellite
SAR and optical sensors image tower sites
2
Ground Station
Raw imagery downlinked every 12–24 hours
3
Change Detection
AI flags tampering, damage, or encroachment
4
Operator Alert
Security teams receive geo-tagged threat report

Satellites continuously image communications assets, feeding AI analysis that triggers rapid alerts when infrastructure threats are detected.

Page in the build queue

This application has its place in the atlas. The full page — short and long descriptions, what-matters bullets, sovereignty rationale, and the eight-field architecture block — is being written next.

Maturity reading: Operational systems exist with paying customers. Phase 1 built §4.1 (Maritime Intelligence) end-to-end as the depth-and-format reference. Section 4 is the next section to graduate from scaffold to full content; the rest follow on the roadmap.

Related applications

8.6.2 · Previous

Power Grid Threat Surveillance

All in infrastructure threat monitoring

8.6.4 · Next

Transport Hub Security

Bring this into your sovereign programme.

All solutions Speak with engineering