What is SIGINT?

SIGINT (Signals Intelligence) is intelligence derived from electromagnetic signals: radio transmissions, radar, cell networks, satellite communications. The US NSA is the primary SIGINT agency.

Three subcategories:

  • COMINT: Communications Intelligence. Intercepting radio, phone, internet traffic.
  • ELINT: Electronic Intelligence. Non-communications signals: radar, electronic warfare emissions, navigation beacons.
  • FISINT: Foreign Instrumentation Signals Intelligence. Telemetry from missiles, spacecraft, research facilities.

Signal Types in 2026

RF Spectrum

Radio frequency signals occupy 3 Hz to 300 GHz. Military, civilian, and unlicensed bands all carry exploitable signals:

  • HF (3-30 MHz): Long-distance radio, military comms, amateur radio. Propagation via ionosphere reflection. Exploitable but requires antenna arrays.
  • VHF/UHF (30 MHz - 3 GHz): Air traffic control, maritime, law enforcement, cellular. Line-of-sight propagation. Easier to intercept than HF.
  • Microwave (3-30 GHz): Satellite communications, backhaul links, radar. Directional antennas needed.

Network Signals

Internet traffic (TCP/IP, DNS, BGP). Passively observable at ISP level. ASN routing patterns reveal network topology. Traceroute + TTL analysis maps network infrastructure.

Collection Methods

Passive RF Listening

Deploy Software Defined Radios (SDR) with wideband receivers. Log signal power, frequency, modulation. Tools: GnuRadio (open-source), HackRF (hardware), USRPs.

Challenges: signal-to-noise ratio (weak signals drown in noise), interference (jamming, unintended emissions), propagation (multipath fading).

Network Reconnaissance

Scan internet for exposed services: Shodan, Censys, GreyNoise databases. Query by: port (22 = SSH), service signature, geography. Reveals command-and-control servers, research networks, industrial systems.

// passive OSINT + SIGINT

OSINT (open internet data) + SIGINT (passive signal listening) are complementary. OSINT finds DNS records, WHOIS data, website metadata. SIGINT confirms live infrastructure by detecting actual RF or network emissions.

Analysis Techniques

Signal Classification

Identify modulation type (AM, FM, FSK, PSK, QAM) from raw IQ samples. Use ML: train CNN on known modulations, classify unknown signals. Accuracy depends on SNR (signal-to-noise ratio).

Direction Finding

Triangulate signal source using antenna array. Measure phase/amplitude differences across antennas. With 3+ receivers, pinpoint emitter location to ~100m accuracy (line-of-sight).

Traffic Analysis

Encrypt or not, signal timing reveals behavior: call frequency, message length distribution, temporal patterns. Metadata often more valuable than content.

SIGINT vs OSINT

OSINT: Public data (websites, records, media). Easy to collect, high volume, low reliability (misinformation).

SIGINT: Electromagnetic emissions. Hard to collect (requires equipment, expertise), lower volume, higher reliability (hard to fake signals).

Modern intelligence uses both. OSINT identifies targets; SIGINT confirms.