Tag: cybersecurity

Drones, signals, surveillance – and what happens when we can no longer trust the encryption holding the modern world together.

There is a scene in Terminator 2: Judgment Day where Arnold Schwarzenegger’s T-800 explains how Skynet becomes self-aware and, almost immediately, turns humanity’s own military infrastructure against it.

A defence network becomes intelligent. The machines take control. Humanity suddenly finds itself hunted by technology it created.

Great science fiction.

Except I’m beginning to wonder if we got one part wrong.

Maybe Skynet doesn’t arrive as a single malevolent artificial intelligence.

Maybe it arrives piece by piece.

A drone here.

A satellite there.

A cellular network.

A camera.

A radio receiver.

A location database.

An artificial-intelligence system capable of analyzing all of them.

And somewhere in the middle, cryptography – the thin mathematical layer preventing enormous portions of that infrastructure from being intercepted, impersonated or manipulated.

That is much closer to the technological world I’m building in Cryptogeddon.

And increasingly, I don’t have to invent very much of it.

Because this post is so long, I thought a table of contents might be helpful:

The Drone Will See You Now

On August 6, 2026 – literally as I was working on this post – Reuters published a report from Zaporizhzhia, Ukraine describing what residents have begun calling “safari” attacks.

Small first-person-view drones are being used to attack individual people and vehicles.

Not military formations.

Individuals.

Residents described living with drones capable of appearing overhead and pursuing people through streets and neighbourhoods. Ukrainian officials say the attacks are intended in part to terrorize the civilian population.

Think about how extraordinary that sentence would have sounded twenty years ago.

Today it barely qualifies as science fiction.

Two days earlier, Russia formally demonstrated just how central this technology has become by appointing a commander to its newly created Unmanned Systems Forces – effectively creating a military branch dedicated to drone warfare.

Ukraine and Russia have already produced and deployed drones on an enormous scale. Cheap FPV aircraft costing a tiny fraction of the vehicles and infrastructure they can destroy have fundamentally altered battlefield economics.

A camera.

A radio.

Some electronics.

Explosives.

And an operator.

That alone is frightening.

But now remove the operator from the last few seconds of the equation.

Electronic warfare has made conventional drone control increasingly difficult because radio links can be detected and jammed. The response has been exactly what you would expect from an arms race.

The drones are adapting.

Ukraine has been deploying AI-assisted targeting systems that use onboard cameras to recognize and track targets. Reuters reported in 2025 that some systems can continue toward a target after communications with the pilot are disrupted. Ukrainian officials said human authorization was still required before the strike, an important distinction – but once committed, the machine can increasingly handle portions of the terminal journey itself.

Other drones have eliminated the radio problem altogether.

Russia is now using FPV drones controlled through kilometres of extremely thin fibre-optic cable. Because the control signal travels through a physical wire rather than radio, conventional electronic jammers cannot simply disrupt the connection. Reuters documented Russian fibre-controlled drones being used in 2026 against Ukrainian electrical substations, including attacks against multimillion-dollar transformers. Some of the drones cost roughly $2,000.

A $2,000 aircraft can now threaten infrastructure worth millions.

No satellite.

No fighter jet.

No exotic weapons platform.

No billion-dollar defence contractor required.

That may be one of the most important themes emerging in Cryptogeddon:

The barrier to entry for sophisticated technological warfare is collapsing.

Before We Had Drones, We Had Wires

There is another reason this should make us uncomfortable.

We’ve already experimented with what happens when governments gain access to enormous amounts of communications data.

It did not begin with drones or AI.

It began with telephone lines and Internet cables.

After the September 11 attacks, the United States dramatically expanded electronic surveillance programs. One of the most controversial was the NSA’s bulk telephone-records program under Section 215 of the USA PATRIOT Act.

The database did not contain recordings of everyone’s telephone conversations.

It contained something potentially almost as interesting:

metadata.

Who called whom.

When.

For how long.

Patterns.

Connections.

Networks of relationships.

The U.S. Privacy and Civil Liberties Oversight Board ultimately concluded that the bulk program lacked a viable legal foundation under Section 215, raised serious constitutional and privacy concerns, and demonstrated only limited value. The program was subsequently ended in that form.

Meanwhile, Internet communications presented an even larger opportunity.

NSA surveillance under Section 702 includes what is known as upstream collection.

The government’s own Privacy and Civil Liberties Oversight Board describes upstream collection as occurring at portions of the telecommunications backbone itself – long-distance fibre connections, network exchange points and other places through which enormous volumes of Internet traffic transit.

Traffic is screened for communications associated with approved foreign-intelligence selectors before qualifying communications are collected.

There is an important distinction here: Section 702 is a legally authorized foreign-intelligence program with oversight mechanisms, not simply a machine indiscriminately storing the entire Internet.

But technologically, consider what had happened.

We had learned how to place surveillance at the arteries of the Internet.

AT&T technician Mark Klein made that concept disturbingly tangible when he disclosed the existence of the infamous Room 641A in an AT&T facility in San Francisco. Documents he provided to the Electronic Frontier Foundation described optical splitters capable of duplicating telecommunications traffic and feeding copies toward equipment associated with NSA surveillance.

The architecture of surveillance was relatively straightforward.

Find the place through which enormous amounts of information pass.

Put your collection system there.

Listen.

That model worked remarkably well when communications flowed through centralized infrastructure.

But then the world changed.

The wires disappeared.

Surveillance Escaped Into the Air

Today our devices communicate constantly.

Cellular.

Wi-Fi.

Bluetooth.

GPS.

Satellite.

Radio.

Vehicle systems.

Drones.

Wearables.

Industrial telemetry.

The communications infrastructure that once passed primarily through identifiable wires and switching facilities has expanded into an electromagnetic environment surrounding us almost everywhere.

That creates an entirely new category of intelligence.

Consider your phone.

Law-enforcement agencies have used devices commonly known as Stingrays, or cell-site simulators, which behave like cellular infrastructure and cause nearby phones to identify themselves.

The U.S. Department of Justice eventually adopted a policy generally requiring federal investigators to obtain warrants before using them.

Canada uses the technology too.

An investigation by the Office of the Privacy Commissioner of Canada confirmed that the RCMP used cell-site simulators capable of collecting identifiers such as IMSI and IMEI numbers. The RCMP told the commissioner that its systems were not configured to intercept the contents of calls, emails or text messages.

Again:

you don’t necessarily need the message.

Sometimes knowing that a device exists somewhere is enough.

Knowing that it was there yesterday is better.

Knowing that another device was repeatedly nearby becomes interesting.

Knowing where both devices travel afterward becomes intelligence.

And governments are no longer the only organizations capable of collecting this kind of information.

Your Location Became a Commodity

The commercial advertising ecosystem created an enormous location-surveillance infrastructure almost accidentally.

Apps collect information.

Advertising networks exchange information.

Data brokers aggregate information.

And eventually someone realizes that the dots on the screen correspond to actual human beings.

In 2024, the U.S. Federal Trade Commission alleged that a company called Mobilewalla had collected more than 500 million unique advertising identifiers paired with precise location information between 2018 and 2020.

The FTC said the company collected some of this information through real-time advertising auctions – even when it did not win the advertisement.

The agency also alleged that Mobilewalla used location information associated with people attending protests following the killing of George Floyd to produce an analysis of protesters, including demographic information and whether they lived in the cities where they demonstrated.

Think about that for a moment.

Advertising technology became protest-surveillance technology.

Another FTC case involved Gravy Analytics and Venntel. The FTC alleged that location information could reveal visits to healthcare facilities, religious institutions and other sensitive locations. The companies had claimed to process more than 17 billion signals from approximately one billion mobile devices every day.

Seventeen billion.

Every day.

This isn’t someone following you around in a trench coat.

It is industrialized observation.

And that happened before we added today’s generation of AI systems to the equation.

Now Look Up

Perhaps the most astonishing example I found while researching Cryptogeddon came from researchers at the University of California San Diego and the University of Maryland.

They pointed a commercially available satellite dish at the sky.

Their equipment cost about $800.

Then they listened.

What they discovered should terrify anyone who assumes important communications are automatically encrypted.

Their 2025 research found large amounts of sensitive information travelling over geostationary satellite links without encryption.

They observed cellular traffic.

Voice calls.

SMS messages.

IMSI identifiers.

Corporate communications.

Government communications.

Military-related information.

Airline Internet traffic.

Utility information.

Oil-and-gas infrastructure traffic.

Even communications associated with industrial control systems.

The researchers emphasized that their monitoring was completely passive. They did not have to compromise the satellites or transmit anything.

They simply listened to signals that were already being broadcast toward Earth.

University of Maryland researchers described using the roughly $800 setup to examine 38 satellites covering an enormous geographical area.

The research team concluded that a surprisingly large amount of sensitive satellite traffic remained exposed.

Some affected organizations subsequently encrypted their communications.

That is an encouraging response.

The disturbing question is obvious:

Who else had already been listening?

Radio Has Always Betrayed Us

Militaries have understood this problem for more than a century.

You don’t have to break a radio transmission’s encryption to learn that a radio is transmitting.

Direction-finding equipment can locate transmitters.

Signal strength changes.

Patterns emerge.

Units move.

Networks appear.

The U.S. military was using radio direction finding to locate enemy transmitters as early as World War I and extensively during Vietnam.

The principle hasn’t changed very much.

The equipment has.

During the war in Ukraine, poorly secured Russian communications created intelligence opportunities almost immediately. RUSI researchers documented reports of Russian forces relying on unencrypted radios and ordinary mobile phones. Such transmissions can potentially allow an opponent not merely to listen but to determine where transmitters are located.

Smartphones are particularly dangerous on a battlefield because they combine communications with location information, cameras and Internet connectivity.

In 2024, Russia moved toward punishing soldiers for carrying smartphones in combat zones specifically because phones could expose positions. Reuters reported that both sides had used mobile devices and their associated signals, photographs and messages to help identify targets.

The lesson is brutally simple:

transmitting can reveal you.

And once something can be located, something else can be sent to it.

Possibly a drone.

The Battle Over Communication

That brings us to another important part of Cryptogeddon.

Communication doesn’t merely need to be intercepted.

It can be denied.

Modern warfare increasingly includes attempts to jam radio communications, interfere with drone-control links and disrupt satellite navigation.

A drone may still be physically intact yet become useless because it can no longer communicate with its pilot.

A military unit can possess weapons and ammunition and still become ineffective if its command network disappears.

A satellite can remain perfectly healthy while users on the ground suddenly lose access to the network.

That last scenario has already happened.

Approximately one hour before Russia invaded Ukraine on February 24, 2022, a cyberattack struck Viasat’s KA-SAT satellite network.

The European Union formally attributed the attack to Russia and said it caused communications disruptions affecting Ukrainian authorities, businesses and users as well as users elsewhere in Europe.

The shooting hadn’t even properly started yet.

The communications war had.

And the response to this vulnerability is creating another technological arms race.

Modern systems can switch frequencies.

They can use multiple communications paths.

Military networks can fall back between satellite, terrestrial radio and other systems.

Drones can use onboard navigation when satellite positioning becomes unreliable.

AI-assisted systems can continue portions of missions after control links disappear.

Some drones now use fibre.

Modern militaries are reconsidering older HF radio systems precisely because satellite communications may not always be available in a major conflict. A June 2026 U.S. Army paper explicitly described modern battlefields in which satellite communications may be jammed or denied.

The objective increasingly becomes not simply secure communications.

It becomes resilient communications.

Assume something will be intercepted.

Assume something will be jammed.

Assume GPS may disappear.

Assume networks will fail.

Then build systems capable of surviving anyway.

And Then AI Starts Listening

This is the piece that changes everything.

Signals intelligence isn’t new.

Surveillance isn’t new.

Drones aren’t new.

Location tracking isn’t new.

Satellite interception isn’t new.

What is new is our rapidly improving ability to combine enormous quantities of information automatically.

Imagine thousands of sensors listening simultaneously.

Most of what they collect is useless.

Cars.

Air conditioners.

Commercial radio.

Bluetooth devices.

Cell phones.

Aircraft.

Drones.

Electrical equipment.

Random interference.

A human analyst would drown in it.

AI doesn’t have to.

Machine-learning systems can classify radio signals and identify patterns across spectrum data. Researchers have demonstrated deep-learning systems capable of automatically distinguishing radio signal types, and DARPA has spent years developing machine-learning technologies capable of managing and interpreting crowded electromagnetic spectrum environments.

Ukraine offers an even more tangible example.

Its distributed acoustic drone-detection networks use large numbers of inexpensive sensors to listen for incoming drones. NATO research published in 2026 described systems using AI to distinguish drone sounds from ordinary background noise.

Some implementations even leverage commercial technology such as smartphones as processing components.

Think about the architecture.

Thousands of cheap sensors.

A communications network.

Artificial intelligence.

A map.

Now replace microphones with radio receivers.

Add cellular information.

Add cameras.

Add satellites.

Add drones.

Add commercial location databases.

Add compromised computer networks.

Add historical information.

Suddenly you’re no longer collecting signals.

You’re constructing reality.

This Is Where Cryptogeddon Begins

And sitting underneath almost all of this is cryptography.

Encryption protects our messages.

Cryptographic signatures verify software.

Certificates establish trust between systems.

Authentication protects networks.

Encryption protects financial transactions.

VPNs protect remote communications.

Cryptography protects military command systems.

Cryptography protects governments.

Cryptography protects the Internet.

Which raises the question at the heart of the series I’m writing:

What happens when we stop being able to trust it?

That doesn’t necessarily require someone discovering a magical equation capable of instantly breaking AES.

History shows that cryptographic systems can fail in far messier ways.

In 2011, the Dutch certificate authority DigiNotar was compromised. Attackers generated fraudulent certificates for major services including Google. European cybersecurity agency ENISA reported that fraudulent certificates were subsequently used to eavesdrop on users in Iran.

The encryption wasn’t necessarily mathematically defeated.

The trust mechanism surrounding it was compromised.

That’s an important distinction.

Sometimes you don’t break the lock.

You steal the key.

Sometimes you convince everyone that your key is legitimate.

Sometimes you compromise the machine before encryption occurs.

Sometimes you compromise it after decryption.

Sometimes you simply jam the communication so nobody can talk at all.

And sometimes – as those satellite researchers discovered – the people operating the system inexplicably forgot to lock the door in the first place.

There is another problem approaching.

Quantum computing.

We do not currently have quantum computers capable of casually breaking the cryptographic systems protecting the Internet.

But the threat is considered serious enough that the U.S. National Institute of Standards and Technology finalized its first post-quantum cryptographic standards in 2024 and urged organizations to begin migrating.

NIST specifically warns about “harvest now, decrypt later.”

An adversary does not need to decrypt sensitive information today.

They can collect encrypted traffic today.

Store it.

And wait for the technology capable of breaking it tomorrow.

That creates a deeply uncomfortable thought.

Some secrets being transmitted right now may already be compromised.

We just don’t know it yet.

The Democratization of Intelligence

There is one final development that I think may prove as important as any of the others.

This technology is becoming cheap.

Historically, serious surveillance required governments.

Satellites.

Listening stations.

Aircraft.

Mainframes.

Teams of analysts.

Enormous budgets.

Today a university research team can intercept satellite communications with equipment costing hundreds of dollars.

Commercial drones cost hundreds or thousands.

Software-defined radios place capabilities that once required specialized equipment within reach of hobbyists and researchers.

Cloud computing provides enormous processing capacity on demand.

Open-source software provides sophisticated analysis tools.

AI systems can write code, recognize objects, transcribe speech, classify information and identify patterns.

High-resolution satellite imagery is commercially available.

Billions of location observations have been collected by advertising companies.

And military drones capable of destroying vastly more expensive equipment can cost a few thousand dollars.

This does not mean everyone suddenly possesses the NSA’s capabilities.

They don’t.

Nation-states still possess extraordinary advantages in sensors, access, scale and expertise.

But the gap is narrowing.

Capabilities are leaking downward.

From superpowers.

To militaries.

To intelligence agencies.

To corporations.

To criminal organizations.

To small groups.

Eventually, to individuals.

That may turn out to be one of the defining technological stories of our time.

Skynet Doesn’t Need to Wake Up

That’s what makes the world of Cryptogeddon frightening to me.

I don’t need to invent a conscious artificial intelligence that suddenly decides humanity should die.

I don’t need killer robots marching down city streets.

I don’t need a supercomputer launching nuclear missiles.

The infrastructure is already considerably more interesting than that.

We have drones capable of hunting targets.

We have machines capable of continuing toward those targets when communications disappear.

We have systems designed to detect and locate radio transmitters.

We have commercial databases containing extraordinary records of human movement.

We have satellites broadcasting information across continents.

We have governments capable of collecting communications from Internet infrastructure.

We have inexpensive receivers capable of listening to signals falling from space.

We have artificial intelligence increasingly capable of turning oceans of sensor data into useful information.

And we have tied virtually every important component of civilization together with cryptography.

Banking.

Energy.

Transportation.

Military systems.

Governments.

Corporations.

Communications.

Identity.

The Internet itself.

Maybe Skynet doesn’t arrive when a machine becomes conscious.

Maybe Skynet arrives when all of our machines become connected.

And maybe Armageddon doesn’t begin when the machines decide to kill us.

Maybe it begins when the cryptography connecting them can no longer be trusted.

That’s Cryptogeddon.

And increasingly, I’m not sure I’m writing science fiction.