All techniques
REC-0003.03
ST0001Reconnaissance
sub-technique

Mission-Specific Channel Scanning

Parent: REC-0003

Description

Beyond TT&C, many missions expose additional RF or network surfaces: high-rate payload downlinks (e.g., X/Ka-band), user terminals, inter-satellite crosslinks, and hosted-payload channels that may be operated by different organizations. Adversaries scan spectrum and public telemetry repositories for these mission-specific channels, characterizing carrier plans, burst structures, access schemes (TDMA/FDMA/CDMA), addressing, and gateway locations. For commercial services, they enumerate forward/return links, user terminal waveforms, and provisioning backends that could be impersonated or jammed selectively. In hosted-payload or rideshare contexts, differences in configuration control and key management present opportunities for pivoting between enclaves.

Mappings

EU regulation articles

  • eu-space-actArt. 80(3)
    addresses
    moderate
    direct

    Mission-specific channel configurations (carrier plans, burst structures, gateway locations) are operator-controlled artifacts within 80(3)'s scope.

ENISA controls

  • Transmission security defeats characterisation of mission-specific carrier plans, burst structures, and access schemes that REC-0003.03 enumerates.

  • Space-based RF mapping is the defensive analogue: detecting an adversary's scan of mission-specific channels.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, REC-0003.03 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.