TOP

 

It is amazing what you can learn from a phone call. Cell-, smart- and satellite phones (satphones) have revolutionised civilian communications. We can reach anyone, anywhere at anytime from a device in our hands at the speed of light. We enjoy unlimited access to torrents of information as our smartphones and tablets suff the internet. However, such tools are essential for insurgents. These devices give guerrillas the equivalent of a military tactical radio and battle management system.

Moreover, war-torn states around the world like Afghanistan and Syria retain cellphone networks. Where such communications are unavailable satphones fill the long-range gap, with civilian radios meeting short-range needs. When the author asked one European Communications Intelligence (COMINT) professional about the preferred short-range communications of IS (self-proclaimed Islamic State), they replied “Motorola”.

An insurgent’s reliance on conventional communications gives a useful means by which their movements can be tracked and their chatter monitored. As this article will show, air operations in Libya have placed a premium on COMINT collection. Libya, which remains locked in civil war, has seen an array of private companies gathering COMINT, not only contributing to national intelligence pictures, but also assisting covert operations, plugging gaps in airborne ISR shortfalls and giving real-time ISR (Intelligence, Surveillance and Reconnaissance) support to belligerents on the ground.

 

Got Your Number!

Broadly speaking, civilian communications are performed in a three megahertz/MHz to five gigahertz/GHz waveband. This encompasses high frequency radio (three megahertz/MHz to 30MHz) and Very/Ultra High Frequency (V/UHF) communications across a 30MHz to three gigahertz waveband. Further up the spectrum, several commercial Satellite Communications (SATCOM) providers like Thuraya, Iridium, INMARSAT/ISatPhone and LightSquared/Ligado use wavebands of 1.525GHz to 1.646GHz. Meanwhile, cellular protocols such as LTE (Long Term Evolution) employ frequencies from circa 460MHz to 5.8GHz, while GSM (Global System for Mobile Communications) uses frequencies of 900MHz to 1.9GHz. Whenever someone uses a communications device they announce their presence. This is because their equipment transmits RF (Radio Frequency) energy. In the counter-insurgency context, COMINT serves two purposes:

Firstly, a High Value Individual (HVI) can be physically tracked by their cellphone using their IMSI (International Mobile Subscriber Identity) number. Every cellphone has an IMSI. It is a unique numerical code detailing where the phone is registered, the network it uses within that country and the phone’s Mobile Subscriber Identification Number (MSIN). The MSIN is the number assigned to that particular phone which identifies it to a cellphone network. Every time a phone joins a network it transmits its IMSI as a digital ‘handshake’. The network responds by providing the phone with a randomly-assigned Temporary Mobile Subscriber Identity (TMSI) code. The TMSI can be changed for that phone at any given moment. This is to frustrating attempts by eavesdroppers to identify and track the phone via its IMSI. That said the IMSI still has to be used, albeit briefly, to perform the digital handshake and rejoin the network if the connection is lost. Every time the phone moves away from one part of a network’s coverage into another, the IMSI is sent anew, and the process repeated. As an individual moves around a city, and between nodes in a network, their phone transmits their IMSI and receives a TMSI.

An aircraft is a practical tool for COMINT. It can loiter high above the ground out of visual or audible range. If the person’s IMSI is known, the aircraft’s COMINT system can detect when that phone emits this unique number, locate the signal and then use onboard optronics to see the person and match the IMSI and TMSI. The ability to visually fix the position of an individual may be useful if the intention is to apprehend or attack them, or to simply shadow their movements.

Secondly, the communications traffic of one, or several HVIs, can be detected and demodulated. This process isolates the information-bearing part of a signal is extracted from the signal’s carrier wave, revealing the traffic’s content. Demodulation can be performed on a wide array of signals. Horizon Technologies’ Flying Fish airborne SIGINT system can be used to detect emissions from satphones, principally those using the Thuraya and IsatPhone Pro networks. Flying Fish be used to geo-locate the signals’ source and its software used to decrypt the communications.

The use of companies to provide aerial ISR has been in the public domain for several years. The Libya theatre has seen significant private-sector aerial ISR provision. In November 2017, an online resource revealed that Airtec, a company based at St. Mary’s County Regional Airport, Maryland, had started flying a Beechcraft KING AIR-200 turbofan ISR aircraft from Luqa Airport, on the island of Malta. This work is understood to have been performed on behalf of the US government.

During Maltese deployment the aircraft reportedly performed several sorties over the cities of Benghazi in eastern Libya, and Misrata in the west. The report stated that Airtec is one of several firms which have performed such missions. The others being Blue Ridge Aero Services, Commuter Air Technologies, L3 Technologies, M&N Aviation and Sierra Nevada Corporation (SNC). That same month the website reported that SNC had performed ISR sorties on behalf of the US Department of Defense (DoD) using a Beechcraft King Air-350 stationed at Sigonella airbase on the island of Sicily. The company was said to have deployed four aircraft to assist the ISR-gathering, with the firm focusing its efforts on the provinces of Misrata and Sirte on the country’s western coast. Both of these provinces were believed to be hosting ISIS cadres.

 

British Beechcraft King Air 350-derived SHADOW R.1. (Image copyright Crown)

 

The website also revealed that private-sector aerial ISR collection seemed to have commenced in 2016. The chief ‘customers’ for the intelligence are thought to have been the CIA and the US Special Operations Command (USSOCOM). The work performed by the various contractors has been distinct yet interrelated. CIA-sponsored airborne ISR-gathering may have been performed to support specific agency efforts within Libya, as well as supporting the wider intelligence ‘take’ regarding the ongoing situation in the troubled country. Intelligence-gathering performed on behalf of USSOCOM could have been to support missions of a more ‘military’ nature where US commandoes may have assisted sympathetic local forces, or performed actions against US adversaries such as ISIS. Inevitably there will have been crossovers between these missions and USSOCOM and the CIA almost certainly have worked closely with each other.

 

Tunisia

Such efforts have not only been confined to Libya. In 2015 an SNC Dornier-328 series turboprop was reported to be flying intelligence-gathering missions over Tunisia. The reason for such flights could be to monitor the country’s territory for signs of insurgent incursions. Tunisia shares its southeast border with Libya and has also been no stranger to Islamist violence. One attack perpetrated on 18 March 2015 at the Bardo National Museum in Tunis killed 22. A further 38 were slain on the beach in the city of Sousse, to the south of Tunis. Open sources note that the country’s air force lacks any dedicated fixed-wing reconnaissance planes. SNC may have performed its missions to gather intelligence on behalf of both the Tunisian and US governments.

The US is not the sole country hiring private contractors to perform aerial ISR gathering in Libya. Recent reports indicate that the French government has taken a similar course of action. On 7 May, the Libyan House of Representatives, one of Libya’s legislatures based in the eastern city of Tobruk, commenced an offensive to liberate the city of Derna in the east of the country. The city was under the control of the Shura Council of Mujahideen in Derna (SCMD), an Islamist coalition which had in turn captured the city from ISIS. ISIS had occupied Derna on 5 October 2014. The uprising commenced in June 2015 and by April 2016 ISIS had left. Libyan National Army (LNA), which is loyal to the House of Representatives, besieged Derna from August 2016 with the objective of removing the SCMD. The LNA’s offensive commenced on 7 May.

France supported the effort employing private-sector aerial ISR to assist the LNA’s manoeuvre. This included the lease of a King Air-350 from Luxembourg-based CAE Aviation (not to be confused with the CAE which manufactures flight simulators). The aircraft was deployed to Al Khadim airbase in eastern Libya. There, it shared the ramp with several Ayres Corporation S2R Archangel turboprop counter-insurgency aircraft belonging to the United Arab Emirates Air Force. These planes were believed to have provided close air support during the LNA offensive. ISR-gathering missions on 16 May as the LNA advanced into Derna’s southern suburbs. The King Air-350 continued to perform ISR-gathering up to the city’s liberation on 28 June.

Reports continued that the King Air-350 was equipped with undisclosed optronics, although confidential sources informed MONCh that these may have been supplied by L3 Wescam. Combining an ISR aircraft with assets like the S2R provides a capable, yet cost-effective, precision strike force: HVIs can be detected via their communications traffic; located and observed; with their coordinates being shared with the armed platforms for the attack.

Returning to Tunisia, the shortage of ISR aircraft in that country’s air force has seen CAE Aviation assist ISR collection for the Tunisian government. Such intelligence may also be shared with the French General Directorate for External Security, the country’s foreign intelligence service, and French Military Intelligence. Other initiatives have been performed by CAE Aviation for the European Border and Coast Guard Agency (a.k.a. Frontex); the European Union’s external border control organisation. These operations have aided Frontex’ detection of boats laden with refugees traversing the Mediterranean heading to southern Europe.

CAE Aviation, the beforementioned webside expands, has assisted the French-led Operation 'Barkhane' counter-insurgency effort in the Sahel region of North Africa directed against armed Islamist groups active there. The reliance placed on CAE Aviation reflects the fact that the French Armed Forces in general currently lack a theatre-level ISR-gathering aircraft. In July 2016 it was revealed France had purchased two King Air-350s outfitted with optronics and a Thales COMINT package, suspected to be firm’s ACS scalable airborne COMINT system. Although not confirmed by the company, the ACS should cover the all-important 3MHz to 5GHz waveband. As of this year, it is believed that theFrench Air Force has taken delivery of these planes which may now be flying missions in the Sahel.

 

Benefits

The privately-owned provision of aerial ISR has two important benefits for the nations leasing such services. Most obviously, it provides additional intelligence-gathering assets. Both France and the US boast well-equipped intelligence services, and handsome fleets of dedicated reconnaissance aircraft.

The US Air Force is equipped with the world’s largest dedicated reconnaissance-gathering fleet including 27 of the famous Lockheed Martin U-2S DRAGON LADY intelligence-gathering aircraft. Meanwhile, French Naval Aviation possesses 22 Dassault/Breguet Atlantique ATL-2 maritime patrol aircraft. These have also supported Operation 'Barkhane.' Nevertheless, such assets are constantly in demand and fleet sizes maybe insufficient to cover the entirety of operations.

More intriguingly, the use of private-sector aerial ISR gives a nation a degree of strategic ‘distance’ from a conflict: On the one hand, a country maybe financing and benefiting from leased airborne ISR activities, while seemingly superficially uninvolved. Country ‘A’ can claim it is uninvolved in country ‘B’s civil war, despite country ‘A’ leasing an aircraft with gathers intelligence on the conflict on a weekly basis. So-called plausible deniability remains an important asset in the intelligence operative’s manual, as exemplified by the use of private-sector airborne ISR.

Dr Thomas Withington

 

Broadly speaking, civilian communications are performed in a three megahertz/MHz to five gigahertz/GHz waveband. This encompasses high frequency radio (three megahertz/MHz to 30MHz) and Very/Ultra High Frequency (V/UHF) communications across a 30MHz to three gigahertz waveband. Further up the spectrum, several commercial Satellite Communications (SATCOM) providers like Thuraya, Iridium, INMARSAT/ISatPhone and LightSquared/Ligado use wavebands of 1.525GHz to 1.646GHz. Meanwhile, cellular protocols such as LTE (Long Term Evolution) employ frequencies from circa 460MHz to 5.8GHz, while GSM (Global System for Mobile Communications) uses frequencies of 900MHz to 1.9GHz. Whenever someone uses a communications device they announce their presence. This is because their equipment transmits RF (Radio Frequency) energy. In the counter-insurgency context, COMINT serves two purposes

Horizon Technologies’ FLYING FISH COMINT system can outfit bizjets-sized platforms, and detect and decrypt satphone traffic. (Photo: Horizon Technologies)

We use cookies to improve our website and your experience when using it. Cookies used for the essential operation of the site have already been set. To find out more about the cookies we use and how to delete them, see our privacy policy.

I agreeMore Information