The Drone Is Also a Subscriber

Most counter-drone thinking assumes the defender and the aircraft are alone: a sensor, a threat, and whatever the defender can emit or fire. But a growing share of long-range unmanned aircraft fly on somebody's mobile network — a small cellular module aboard carries commands out and video back over the towers that serve the road below.

That mobile operator is not neutral. It has an operations centre, a legal department, and an interest in not having its towers used to guide a weapon. In the moment that matters, it is also the only party that can see the aircraft's connection from the inside.

This post covers what a cooperating operator can do, what a thermal detection system must hand it to act in seconds rather than hours, and where it stops helping.

The network already knows something is flying

The operator can spot airborne devices without buying any counter-drone equipment.

A connected device produces a continuous stream of measurements, and some of them look wrong for a phone. The distance and altitude figures the network derives sit outside the range a handset on the ground normally occupies. A device in the air sees many towers at once, so it reports strong simultaneous signal from towers that buildings and terrain would hide from each other at street level. And it changes sectors in a pattern that traces a flight path, not a road: straight lines across the sector map, turns no vehicle would make, speeds that do not fit traffic.

This is behavioural detection over data the network already collects. An operator who chooses to look can build a standing filter for airborne-behaving devices.

The problem is what that filter returns. Across a metropolitan network it returns a lot — legitimate aircraft, devices on tall structures, measurement artefacts. A list of candidates is not an identification, and an operations centre cannot act on a list.

A bearing and timestamp collapse the list

Operators disconnect devices every day; what they have never had is a way to know which device, fast enough to matter.

Behavioural detection alone produces a population, and reducing a population to a suspect is slow, arguable work. A passive thermal sensor supplies the missing quantity. It sees the aircraft by its own heat, whether or not it transmits, and outputs a track: a bearing from a surveyed position, an elevation, a direction of travel, and a timestamp good to the frame.

Hand that to the operator in real time and the geometry does the work. The operator intersects the sector map around the sensor with the bearing and direction of travel, filters to the seconds either side of the timestamp, and asks which airborne-behaving candidate was moving along that line at that moment. The realistic outcome is one or two candidates rather than thousands, in the time a query takes rather than the time an investigation takes.

That changes what the detection system is here. It is not alerting a human or cueing a shooter. It supplies the parameter that turns the operator's broad statistical filter into a specific identification — a targeting cue for a response that happens entirely inside somebody else's infrastructure.

It cuts the other way too: without the network side, a thermal track tells you something is there and does nothing to the aircraft. The two halves are worth more together, as with every layer in a layered defence.

Cutting the link, with nothing emitted

Once the connection is identified, the operator can act with no new equipment and no cooperation from the aircraft.

It can force the device off the network. It can suspend the subscriber identity on the card so a reconnection attempt fails to authenticate. It can block the server the device is trying to reach, leaving the connection nominally alive but useless. Or — worth the most to an investigator — it can redirect the traffic into a monitored dead end, where the aircraft believes it has a link while everything it sends is captured and traced.

The established alternative is jamming, and it has three costs that never go away. It is indiscriminate: it takes down everything else in that band within its footprint, including the phones of the people you are protecting. It is heavily regulated, and around controlled airspace and civil infrastructure that typically amounts to a prohibition for anyone but a specifically authorised state user. And it emits, announcing both that you are there and where.

A network-side disconnection transmits nothing and affects nothing outside the identified connection. It happens at the operator's own console, on infrastructure already lawfully entitled to disconnect a device on it. Our inference: this is why a carrier's operations lead would engage at all. The counter-drone argument alone is somebody else's problem; contributing a decisive effect with a mechanism they already own, without radiating anything or degrading service to any other subscriber, is not.

The hardware keeps its own name

Suspending the subscriber identity handles the account, not the airframe — the obvious countermeasure is a second card.

The cellular module carries a hardware identifier separate from the subscriber identity, and it can be blocked at network level too. Block both, and an aircraft that lands, gets a fresh card and takes off again finds the network still refusing it.

This defends against reuse; it is not permanent removal. On some modules the identifier can be changed, and a replaced module defeats it outright. The blacklist buys time and imposes cost on the other side — the currency most counter-drone measures are actually paid in.

None of this is an improvised call

Every capability above exists today, but none is available during an incident to a defender who has not arranged it in advance.

A cold request from an organisation with no standing relationship becomes a support ticket: triaged, escalated, checked with legal, and answered — correctly — in hours or days. A terminal approach takes seconds.

What makes the capability real is organisational: a standing real-time coordination channel agreed with the operator's operations team beforehand. A named contact, an authenticated path for passing a bearing and a timestamp, a pre-agreed legal basis for the disconnection, and a rehearsed sequence, so disconnection is a procedure being executed rather than a decision being taken. That groundwork is the capability; the technical mechanisms are the easy half.

Where this stops working

Cutting the connection only defeats an aircraft that is still relying on the network to navigate — read this before treating any of the above as a plan.

Many are, for most of their flight: the link is how they receive commands and send back what they see. An aircraft that has switched to self-contained guidance — inertial navigation toward a stored coordinate, or a visual lock on its target — no longer needs the network. Disconnecting it removes the operator's ability to change its mind, and nothing else. It keeps flying. It still arrives.

That switch is deliberately placed at the end of the flight, because that is when the link is most likely to be contested. So the window in which disconnection is decisive closes as the threat becomes most acute: a defence built on it alone has its effect when the aircraft is furthest away and its failure when it is closest.

The requirement follows: pair this approach with a local physical intercept for the terminal phase. It buys distance, time and, through the monitored dead end, attribution. It does not close the kill chain, and anyone presenting it as though it does is selling the easy half of the problem.

The takeaway

This is the layered-defence argument applied to effects instead of sensors. It points at an actor already in the engagement, with the relevant access, who has never been given the one piece of information that would let them use it.

A thermal track's bearing and timestamp are the parameter that turns a mobile operator's list of thousands into a candidate of one. That geometry problem is the only part a detection system contributes.

Everything else is other people's: the operator's network, lawyers and console, and — for the terminal phase this cannot touch — somebody else's physical intercept. That is the correct shape for a counter-drone contribution. The failure mode in this field has always been a vendor describing their own layer as the answer.

This piece sets out an approach to cooperation between a counter-drone detection system and a mobile network operator. It describes capabilities in general terms; specific mechanisms, thresholds and legal bases vary by operator, by network generation and by jurisdiction, and none of it should be treated as a substitute for advice from the operator's own engineering and legal teams. GoTeam builds passive thermal detection — it does not operate a mobile network, and this article does not describe or imply an existing arrangement with any carrier. Commentary is GoTeam's; passages marked as our inference are our own reading rather than established practice.