Sifting signals: A peek behind the curtain

As the electromagnetic spectrum becomes increasingly congested on the highly networked modern battlefield, the road to managing the signal noise increasingly seems to lead toward the twin answers of automation and scalability.

Signal detection and COMINT
A stylised picture illustrating the principle of drone-based COMINT. (Mark Cazalet, generated with Nano Banana)
Mark Cazalet

At the Association of Old Crows (AOC) Europe 2026 conference, Warsight got the chance to sit down for an interview with Kevin Davis, Vice President, Spectrum Operations at MPG. MPG is a US company which forms part of the Dover Corporation. For operations in Europe, the company has long maintained a European branch, MPG Europe, headquartered in York, the UK.

Summarising the company’s capabilities, Davis outlined, “we’re in the RF [radio frequency] spectrum….so we’re from DC – literally electrical current – to 40 GHz. We’re moving higher than that, even as we speak,” adding that the company produces, “everything from LNAs [low-noise amplifiers], microelectronics also, to turnkey SIGINT solutions, and we’re in land, sea, air, and space domains.”

Our subsequent discussion provided a glimpse into the murky world of communications intelligence (COMINT) and signals analysis, with insights into how artificial intelligence (AI) models are trained to analyse signals, alongside operational insights into how users build, maintain, and share classified threat libraries, as well as some of the solutions being pitched to devolve signals analysis closer to the tactical edge.

Training the machine

Alongside microelectronics, subcomponents and ‘black box’ solutions, the company also developed software for signals analysis, as Davis explained, “our Sentinel software has been in the US government and allied inventories for many, many years.”

However, with an increasingly congested EM spectrum on the modern battlefield, signal analysis is becoming increasingly in demand, and good signal analysts are a precious commodity. To help close the gap in demand for signal analysis and alleviate the task of signal analysts working in a crowded spectrum, MPG has turned to AI, with this feature offered within the company’s Sentinel signal analysis software platform.

Davis elaborated, “so the radio frequency machine learning [RFML] is basically an AI version of a signal analyst. Signal analysts usually look at a screen they’re looking at a signal and they’re saying ‘okay it’s this signal’ – and signal analysts are hard to come by that are really good. And what we’ve done is developed a ‘signal analyst in a box’ where we have an AI kind of model that we train to identify different kinds of signals so what we do is we take the signal analyst out of the loop in that case, other than when they’re training the model. What we’ve done is we’ve turned that RFML basically into an app and so that app can be standalone and it can be operated with other people’s software in particular we can put it on a low-SWaP [size, weight, and power] platform.”

Sentinel signal analysis
Sentinel signal analysis and geolocation are used to provide the inputs for MPG’s RFML model. (MPG)

While it is easy to see how RFML-based automation could be advantageous to speeding up signals analysis, any model is only as good as the data it is trained on. This training task can be quite complicated. In the radar field for example, many countries use at least two sets of frequencies for their radars – one for peacetime and one for wartime. This is precisely to allow radar usage in peacetime without exposing the real frequencies the radar would operate on in wartime, to prevent these signals being collected, added to a hostile power’s threat library, and thereby risking the radar being jammed during a real war.

Indeed, one anecdote Warsight heard from a member of the electronic warfare (EW) community at AOC Europe was that Western signals analysts had previously been fairly confident they knew the range of frequencies used by radars within Russia’s S-400 long-range air defence system. This assessment was based on years of signals intelligence gathering, including during Russia’s deployment to Syria. However, when Russia’s S-400 radars began switching to their real wartime frequencies in the wake of the 2022 invasion of Ukraine, subsequent signals analysis found that these frequencies looked completely different to what was expected.

With this in mind, Warsight asked how MPG collected and validate the data being used to train their AI models, knowing full well that many of the signals collected day-to-day would realistically be using peacetime frequencies, which would not necessarily conform to wartime frequencies.

To this, Davis responded: “it is one of the key learnings from the Ukraine war. You know, nobody wants to show their true frontline capability until you absolutely have to. I mean, the US is no different. We would prefer that, our, unfriendlies, [don’t] know what we’re able to do until we need to really do something.” He added, “So, when it comes to the signal analysis aspect of that type of thing…the way you normally train a model like this is that we’ll have what’s called a signal generator to start with, and so let’s say you have – I’m just going to use AM and FM as an example, the simplest radio signals there are. So you tell the model, ‘here’s an AM radio signal, here’s an FM radio signal’, and you train the model, and then when you put an AM signal into that same thing, it reckons, says, ‘yep, that’s AM, and this is FM’”.

“In the real world, they don’t look like that. What really happens is that that AM signal, like if I had a transmitter, a little walkie-talkie here, and I had the Dragonfly [a direction-finder] over here, it’s going to bounce off the walls, it’s going to bounce off the ceiling, it’s called multi-path, and the signal’s going to look different. And you know, if it’s in the rain, it’s going to look different, HF signals, that are those really long range signals that go halfway around the world…skywave, once it hits that ionosphere, it looks completely different on the way down. Now you have to train the model for every type of condition possible, but you have to do it in the real world, so that means you have to have access to real-world signals. We do, we’ve been doing this for decades. We’ve collected signals, and we continue to, so we’ve been able to take signals that we’ve collected over decades and train the model”, Davis added.

According to Davis, the real-world process of training the model has involved a both use of pre-existing threat libraries available to MPG, along with continuous analyst-driven input based on ongoing signals gathering efforts.

“We employ several signal analysts that all they do is train the model, they look for new signals. Maybe we’ll sit outside an airport and collect signals, well, we have systems around the world to do this, and, we collect that data, and in real-time we say ‘it’s this, this, this’, you know, the model says that, but then it’ll come up and say, ‘this is my confidence for that’, and maybe ‘here’s a 90% confidence that it’s that FM signal that we’ve always been looking at, at this frequency’, and that type of thing, but then you see another one, it says it’s only 40% confident. Okay, what’s going on? And so you take a look at that signal, you may, as an analyst say, ‘okay, this is what’s going on’, and you’re able to raise the confidence the next time it sees that signal, and we continuously do this…Now, one of the things that we do is our RFML model actually creates an image, an actual digital image of every signal…and that enables a signal analyst to very quickly look at thousands of signals at a time, and go, ‘okay, that one is really probably over here, I need more data, though’, and so what happens that the next time that the model sees that, it raises a flag and says, ‘okay, this is really similar to this’, and what happens is that over a time that confidence level goes up.” Davis explained.

A screenshot showing Sentinel RFML automatically identifying signals in the HF frequency band, Region 1. In the bottom-right quadrant, a digital image of each detected signal can be seen, allowing an analyst to examine numerous signals quickly. (MPG)

Keeping sensitive data secret

While the analyst-assisted learning paradigm used to train Sentinel RFML makes sense given the plethora of possible signals and waveforms which may be encountered in the real world, the next question was how this data is fed into Sentinel to allow it to keep evolving. After all, the contents of countries’ electronic signature threat libraries tend to be highly secret. So how does that kind of sensitive data get shared between user and company to further improve the RFML model offered by MPG?

In short, it doesn’t. Davis acknowledged that users will only share such information “sometimes”, adding “if it’s very sensitive, no, we don’t get it back.” So how then is the model intended to learn and grow if its access to relevant information is curtailed by secrecy?

In essence, each user has a specific instance of the model running, and are free to import their own threat libraries into it. This can then be updated with data gathered by both the user and MPG independently, but the data gathered by the user will not necessarily make it back to inform the base model offered by MPG. Such is the cost of preserving secrecy.

Sentinel is also offered with a web interface, to enable hardware-agnostic operation. (MPG)

However, Davis was quick to add that this doesn’t matter at the level of the user, because they would still be able to maintain their classified dataset on their own specific instance of Sentinel. Davis explained, “we also provide services to the US government, and sometimes to allies, where we have our personnel sitting in the seats of those secure facilities, so that sometimes they’re doing that signal analysis, and while we never export that out of a classified environment, it doesn’t matter, because we can continue to feed into the customer base the other signals we’re seeing”

He added, “we don’t need the model outside of a secure facility to look the same way. It doesn’t matter, because what’s important is that that is there, and they’re sharing that data.” MPG also explained that they provide the training tools to update the model in the field, and train users how to train the models themselves.

“The Sentinel RFML module within the US government, or within an allied government, is theirs – they maintain it, they develop it. We support that activity, and really importantly…we listen very hard to any feedback that they give us, and sometimes we’re right there with them in their facilities to be able to do that,” Davis concluded.

So while highly sensitive information will generally remain siloed on the user’s instance of Sentinel, such information may still need to be shared among users, for instance between two allied signals interception services, or different service branches of one country’s military. For this, MPG’s solution is to use essentially a secure server with strictly limited access points, known as ‘Sentinel Hub’.

“We have very secure systems that enable our customers, say one military agency to share data with another military agency with what we call a Sentinel Hub, and the hub is what it sounds like, it’s a network hub where they collect information, they pull it together, their staff or our staff can train models on that hub with unknown signals that come into that hub, and then through that cross-domain, it’s a way of actually working through firewalls” Davis explained.

He added, “one of the biggest challenges today is sharing information like that in secure environments, as you could imagine. Even within – I’ll use the US as an example – the Air Force needs to be able to share with the Army, needs to be able to share with the Navy in a secure environment. I’ve got a ship out at sea. How do I get secure? You know, it’s complex. Our goal is with the hub to provide them mechanisms to do it in a secure environment.”

Signals analysis at the front line

While the secure hub operating model Davis explained provided clarity around how armed forces branches and government agencies can work through firewalls at a high level, Warsight enquired how things would look lower down at the tactical edge. On the highly networked battlefield, militaries are likely to have a need to perform more signals analysis close to the front lines, and with this comes a need to put more such equipment into the hands of personnel at lower levels. RFML appears to provide a fairly straightforward pathway to doing so, as skilled signal analysts are likely to remain a finite and high-demand resource.

In this vein, Davis explained that MPG had partnered with Research Innovations Incorporated (RII) with the development of the Dragonfly portable direction-finder (DF) system, using RII’s Dragonfly signal processing unit as its core, able to run MPG’s Sentinel RFML software model, and fitted with a direction-finding antenna from Alaris Antennas, with an operating frequency range between 20 MHz and 6 GHz.

Dragonfly in pelican case
The portable configuration of the Dragonfly direction-finder shown inside its pelican case. (Mark Cazalet)
The portable configuration of Dragonfly in its assembled form. (Mark Cazalet)
Dragonfly processing unit
This ‘black box’ is the Dragonfly processing unit, forming the foundation on top of which all configurations of Dragonfly are built. (Mark Cazalet)

Outlining Dragonfly, Davis said: “It’s a very low size weight and power SIGINT [signals intelligence] solution. You’re not gonna get it on a DJI Phantom, but you’re gonna get it on an octocopter. So, it’s on that, it’s on USVs [unmanned surface vehicles], other things like that…you can put it in a backpack, you can carry it, you can put it in a vehicle.” He added, “we’re also under contract with the US Air Force to put it onto a platform, I can’t tell you what platform, but it is a US Air Force platform, so we’re in the airborne world, we’re in the drone world.”

Dragonfly on drone
A 3D rendering showing what a notional drone-mounted variant of Dragonfly could look like. (RII)

Going further into Dragonfly’s capabilities, Davis noted, “if I had two dragonflies, then I can geolocate on it, and that’s one of the common CONOPS [concept of operations] to use for these things,” adding, “we can do DF, the angle of arrival, geolocation. If we have three sensors, we can do TDOA [time difference of arrival].”

Regarding the number of Dragonfly DFs that could be networked together, Warsight asked how many it was possible to knit together into a network, to which Davis responded, “you could do hundreds.”

Operating such equipment close to the front lines, however, carries certain risks. For example, such equipment could be easily lost and captured by enemy forces if, for example, the drone carrying it is brought down. As such, Warsight asked how a threat library could be kept secure when operating in such conditions.

Davis responded, “that’s exactly why we developed RFML capabilities, and exactly why we’re working with Dragonfly. Dragonfly is…something that can operate at the front line. In a lot of cases…we’re just collecting information, and then we’re going to take it back physically. It could be that we have a SATCOM [satellite communications] connection, or even a, you know, fibre optic connection, but a lot of cases it’s going to be just that, collecting information. So…the model can be very simple, it’s blank…I’m collecting the information, and I’m just categorising at a very high level, and so there’s not a lot of sensitivity in there.” He added, “an operation wouldn’t put that in harm’s way with the full model.”

Delving deeper into how risks are managed operationally, Davis explained, “a lot of times for a given operation, you’re only interested in certain signals…the example I’ll use is that I may only be looking for a single cell phone, so I may only be looking for a certain type of radio. Years ago, in an African operation that I was familiar with, there was another type of system that was trained just to look for good guy signals and bad guy signals. Anything outside of that was civilian signals, because there were insurgents using a certain type of radio, they bought a bunch of these things, and all you had to do was characterise that radio.”

Learning from the modern battlefield

Finally, Warsight asked about conversations being had with the US armed forces in terms of solutions based on takeaways from Ukraine – such as operating in contested EM environments, or the persistent drone presence.

Davis replied that the US armed forces were “asking for modularity, scalability, and versatility, because of what’s going on in Ukraine, quite honestly. In the past we were really mostly interested in protecting our bases, whether it’s an air force base, a navy base, an army base, that kind of thing. We wanted to see drones coming, we wanted to be able to have effectors to jam those, and that type of thing. And those were pretty sophisticated systems and expensive systems. Now, though, even recently with the Iran war, we saw where drones were targeting, we see it in Ukraine, we saw it in Iran a little bit, where they’re targeting a moving vehicle, and so now…we as an industry are starting to look at how do we provide capabilities to protect the individual. It’s kind of like the counter-IED [improvised explosive device] situation was in Iraq.”

Davis’ mention of the counter-IED efforts in Iraq is perhaps a fitting reference point for US and NATO allied efforts in adapting to current operational realities. As with the IED threat, learning how to operate in a contested spectrum and amid a persistent drone threat will require time, training, investment, and institutional mindset shifts. The US and NATO are still playing catch-up to Ukraine and Russia in adapting to these conditions. Time will tell how sustained the industry shift Davis spoke of will be, but the emergence of smaller, scalable solutions indicates some lessons are being heeded.

Share post

You may be interested in

Categories

All NewsEM/CyberLand

Used tags

AICOMINTElectronic WarfareEWRFSIGINT
Ad

Similar posts