The Drone's Last Mile: Our Own Mobile Networks

As reports continue to emerge of Iranian-launched drones reaching targets across the Gulf and beyond — including Kuwait, Qatar, Bahrain, Saudi Arabia, Oman, Iraq, Jordan, Israel, Azerbaijan and the UAE — most discussion understandably focuses on interception systems, radar coverage, and air defence capacity.

But there is another dimension that deserves closer attention.

Modern mobile networks.

Many long-range one-way attack drones can travel most of their route autonomously using pre-programmed waypoints. However, observations from recent conflicts suggest that some platforms may incorporate commercial communication modules, including cellular connectivity.

This creates an uncomfortable possibility.

A drone could fly hundreds or even thousands of kilometres autonomously, navigating by inertial systems or other methods. Then, as it approaches its destination, it could simply attach to the local mobile network.

At that moment, the same characteristics that make modern telecommunications infrastructure valuable to society — dense coverage, reliable connectivity, and high-bandwidth data services — may inadvertently become advantageous to an attacker.

If available, that connectivity could potentially enable:

  • telemetry and health monitoring of the platform
  • re-targeting updates
  • limited command input during the terminal phase
  • transmission of sensor data or video
  • confirmation of mission success or failure

In other words, the drone's final communications link may not come from the country that launched it.

It may come from the country being targeted.

The extent to which this may already be occurring in current conflicts is difficult to determine from public information. However, it is entirely plausible that such techniques are already being explored and, if not yet widely deployed, may emerge as attackers adapt to evolving defensive measures.

Modern conflict consistently demonstrates a pattern: when traditional communication channels are denied, adversaries seek signals of opportunity within the environment. Civilian telecommunications infrastructure represents one such opportunity.

This discussion is particularly relevant for mobile network operators and government or defence organisations in the Gulf region, but it should not be viewed as a regional issue alone. Long-range drones are proliferating rapidly, and many have operational ranges measured in thousands of kilometres.

Distance from a current conflict zone should not be assumed to provide immunity.

Countries well outside today's areas of conflict may find that similar techniques become relevant in the future as capabilities spread and adversaries adapt.

Mobile networks are not the problem — they are critical national infrastructure. But like many forms of infrastructure, they can become part of the operational environment in modern conflict.

There are several measures that countries and operators may consider to mitigate this risk. This is not an exhaustive list, but it highlights areas where defensive thinking can begin:

1. Signalling-level behavioural analysis

Control plane signalling provides a detailed view of how devices interact with the network. Abnormal mobility patterns, unusual attachment behaviour, or atypical signalling sequences may provide early indicators of non-standard devices operating in the airspace.

It is important to note that identifying such devices is far more complex than simply estimating the speed of a device moving between cells. The behavioural characteristics of a device — as revealed through its signalling activity — must be analysed in context. This requires specialised platforms capable of analysing control plane signalling in real time, producing rapid insights and allowing operators and authorities sufficient time to respond. Such platforms are developed by melrosenetworks.com.

Signalling-level analysis can also reveal the data sessions associated with the device, enabling the drone's connectivity on the mobile network to be identified. Once identified, this opens a number of potential possibilities for authorities and operators to interdict the drone's communications or disrupt its interaction with its operator.

2. Integration with airspace monitoring

Telecommunications data can complement traditional sensors such as radar, RF detection, and other surveillance systems. When correlated with these sources, network data can contribute to a broader situational picture.

3. Policy review for machine-type connectivity

Operators may wish to review how IoT and machine-type SIM profiles are provisioned and permitted to roam, particularly those capable of operating across wide geographic areas. It should also be recognised that hostile drones may simply use standard consumer SIMs.

4. Rapid response frameworks

Operators and authorities may benefit from mechanisms that allow suspicious devices or sessions to be investigated or restricted quickly when credible indicators emerge. This may involve a degree of automation and the application of AI.

5. Cross-sector cooperation

Effective mitigation requires collaboration between telecom operators, regulators, defence organisations, and security agencies. Telecommunications infrastructure increasingly intersects with national security considerations.

None of these measures alone eliminates the challenge. But recognising the potential role of telecommunications infrastructure in modern conflict is an important first step.

As drone technology continues to evolve and proliferate, the battlespace increasingly extends beyond traditional military systems.

It now includes the civilian networks that underpin our connected societies.

Signalling analysis