Network and Communications Monitoring Function

Signal interception is passive: a tapped ground LAN or an intercepted space link produces no traffic for boundary monitoring to observe. The practice governs the network whose taps the technique exploits without detecting the tap.

Siphoning mission data from a foothold in ground infrastructure crosses the external boundary the practice requires be monitored, and boundary monitoring at mission-critical internal points is active detection of the exfiltration.

A breached development or integration environment exfiltrates source, test vectors, and build artifacts across a monitored boundary, which is the detection point the practice mandates.

A partner site sits outside the mission's own boundary, so the practice detects the traffic crossing into mission systems but not collection occurring wholly within the third party.