TI-2026-039F โ The Electromagnetic Battlefield: From IMSI Catchers to the Frey Effect
Series: TI-2026-039 "The Ghost Network" ยท Letter F ยท Published June 23, 2026
Classification: PUBLIC ยท Sources: ISS World surveillance catalogs, Cambridge Consultants presentations, "War at the Speed of Light" (Del Monte), "Guinea Pigs: Technologies of Control," "Hidden Dangers 5G" (Flynn), "Mind Wars" (Moreno), Altron MTTS/Grabber documentation, IEEE/ICES standards papers, NTP cancer studies, LSN OSINT library
I. The Electromagnetic Spectrum as Weapon System
Every frequency band serves dual purposes โ civilian communication AND military/intelligence capability:
| Band | Frequency | Civilian Use | Weaponized Use | Documented By |
|---|---|---|---|---|
| ELF | 3-30 Hz | Submarine comms | Neural entrainment, mood manipulation | "Mind Wars" (Moreno) |
| VLF | 3-30 kHz | Navigation (LORAN) | Earth-penetrating tomography (HAARP) | NSA/NRL papers |
| HF | 3-30 MHz | Shortwave radio | Ionospheric heating, OTH radar | HAARP documentation |
| UHF | 300 MHz-3 GHz | TV, 4G/LTE, WiFi | IMSI catchers, device compromise | ISS World catalogs |
| SHF | 3-30 GHz | 5G, satellite | Directed energy, surveillance mesh | "War at Speed of Light" |
| EHF/mmWave | 30-300 GHz | 5G FR2, 6G research | Active denial (pain), crowd control | US DoD ADS program |
| Microwave | 1-100 GHz | Cooking, comms | Frey Effect (auditory), Havana Syndrome | Frey 1960, Del Monte |
II. IMSI Catchers: Your Phone Betrays You
Cambridge Consultants "Small Cellular Base Station":
- Size: 8cm ร 9cm โ fits in a coat pocket
- Power: runs from battery โ no infrastructure needed
- Capability: IMSI grabbing (unique SIM identity), mobile phone identification
- Use case: "Covert" โ explicitly marketed for covert operations
- Presented at ISS World 2011 โ the "Wiretappers' Ball"
Altron GSM/UMTS Grabber features:
- Deploys local GSM network that phones connect to (fake base station)
- Grabs IMSI (SIM identity) and IMEI (device identity) of all phones in range
- Searches and determines target phone's location
- Emulates any base station in the coverage area (based on NetMonitor data)
- Supports up to 1,000 location detection requests per hour
- Location accuracy: 300-700 meters urban, 1,500-5,000 meters rural
This was 2011. An 8cmร9cm device that impersonates a cell tower and captures every phone's unique identifier within range. Fifteen years later, this technology is consumer-grade. Open-source IMSI catcher implementations exist on GitHub. SDR (Software Defined Radio) hardware costs $25 (RTL-SDR) to $300 (HackRF). Any competent attacker can build one.
The defense: 5G introduced SUPI encryption (replacing plaintext IMSI). But downgrade attacks still work โ force the phone to fall back to 4G/3G/2G where IMSI is transmitted in the clear. Every 5G phone is backwards-compatible with 2G. The weakest generation defines the security floor.
III. The ISS World Surveillance Catalog: What's For Sale
Our OSINT library contains the complete surveillance vendor catalog from ISS World conferences ("Wiretappers' Ball"). Categories include:
| Category | Vendors | Capability |
|---|---|---|
| Tactical GSM/3G Interception | ABILITY, Altron, Shogi, Septier | Real-time voice/SMS intercept within radio range |
| UMTS/Satellite/WiFi Interception | Multiple vendors | 3G data + satellite phone + WiFi capture |
| IMSI Grabbing | Cambridge Consultants, Altron | Identify all phones in area, track movements |
| Lawful Intercept (LI) | Aqsacom, ADAE, SS8, Siemens | Network-level intercept at carrier infrastructure |
| Deep Packet Inspection | Qosmos, Amesys | Parse ALL internet traffic, extract content |
| Speech Recognition | Phonexia, Agnitio | Voice-to-text on intercepted calls, speaker ID |
| Social Network Analysis | SS8, Palantir | Map relationships from communication metadata |
| GPS Tracking | Multiple vendors | Covert GPS devices, phone-based tracking |
| Trojans | Gamma (FinFisher), HackingTeam | Remote device compromise, full access |
| VDSL Interceptor | Amesys | Tap broadband connections at the copper level |
This is the commercial catalog โ available to any government willing to purchase. The same vendors who sell to EU democracies also sell to Egypt, Libya, Bahrain, and Saudi Arabia. Documented by WikiLeaks "Spy Files" and Citizen Lab investigations.
IV. The Amesys Encryption Intercept: Record Everything, Decrypt Later
"The server will, in this solution, not only remain a network relay for all voice communication packets, but also become a recorder for all encrypted communications. All the encrypted communications will be saved in a database on the server with the decryption key, thus you will be able to listen to them later."
Amesys sold its EAGLE surveillance system to Gaddafi's Libya (2007-2011), enabling the regime to monitor the entire national internet. After the Libyan revolution, documents revealed the system intercepted emails of journalists, dissidents, and opposition figures. Amesys rebranded as Nexa Technologies; French courts are now prosecuting them for complicity in torture.
V. The Frey Effect: Sound Directly Into Your Brain
"Cornell University, Frey discovered that he could 'hear' radar. The discovery came after a radar technician told him that he could hear the radar at one particular site where he worked. After some research, Frey ascertained that the sound, heard in the brain, was secondary to the interaction of electromagnetic radiation and brain cells and was not heard through normal hearing mechanisms. It was termed the 'Frey Effect.'" โ 1960
"In 1960, Drs. Joseph Sharp and Allen Frey sought to transmit uttered words directly into the auditory cortex using pulsed microwaves similar to the sound vibrations that a speaker can send. This research gave rise to the 'Frey effect', more commonly known as the 'microwave hearing system'. As early as 1962, Frey's device made it possible, with appropriate modulation, to induce sounds in both deaf and non-hearing people."
This is not fringe science. It is documented in peer-reviewed papers from the 1960s, referenced in US military research, and is the leading explanation for "Havana Syndrome" โ the neurological injuries suffered by US and Canadian diplomats in Cuba, China, and elsewhere since 2016.
"Neurological Microwave Weapons: These weapons attack the human nervous system, typically the brain. At the beginning of this chapter, we covered the egregious effects of the low-frequency microwaves of the Moscow Signal and the Havana Syndrome. Therefore, projecting low-frequency microwaves at humans is, by definition, a neurological microwave weapon. Although it is nonlethal, it can result in permanent brain damage. The United States is silent about deploying or using this type of weapon."
VI. The Moscow Signal: 23 Years of Embassy Irradiation
From 1953 to 1976, the Soviet Union directed a microwave beam at the US Embassy in Moscow. For 23 years, embassy staff were irradiated without their knowledge. When the program was discovered:
- Two US ambassadors to Moscow died of cancer
- Multiple embassy staff developed health issues
- The US government's response: install window screens and classify the incident
- The State Department studied the health effects โ then classified the results
The Moscow Signal operated at power levels below US safety limits โ which tells you what those limits were designed to protect: not health, but the ability to deploy the technology commercially. If the safety limit accounted for the Moscow Signal's effects, 4G/5G would be illegal.
VII. 5G Infrastructure as Surveillance Mesh
"'Small cells' are small, inconspicuous wireless nodes most commonly installed on streetlights and utility poles that immediately improve 4G service by relieving strain on existing infrastructure, and will serve as the backbone for 5G networks by significantly expanding coverage and capacity. Operating at much higher frequencies of between 50-90 GHz, 5G is 20 times faster than 4G, but also much denser."
"Smart cities. The Internet of Things will extend beyond the walls of your home, into your city and onto your roads. Smart utility meters are already sending usage information from individual homes back to utility companies. In a 5G-enabled future, street lights, water mains, sewer systems, and runoff pipes will all be sending continuous information to utility companies so that the city's energy grid can be optimized."
5G requires a small cell every 100-300 meters (mmWave cannot penetrate buildings). This creates an electromagnetic grid so dense that:
| Capability | 3G/4G | 5G | Surveillance Implication |
|---|---|---|---|
| Cell density | 1 tower / kmยฒ | 10-100 cells / kmยฒ | Location tracking precision: meters, not hundreds of meters |
| Connected devices | ~10,000/cell | 1,000,000/kmยฒ | Every device is individually addressable and trackable |
| Latency | 50ms | 1ms | Real-time control of remote devices (drones, vehicles) |
| Bandwidth | 100 Mbps | 10-20 Gbps | Full video surveillance at every node is feasible |
| Beam steering | Broadcast | Directed beams (MIMO) | Individual targeting โ beam follows specific device |
| Network slicing | One network | Virtual private networks per-customer | Separate "government" slice invisible to civilian monitoring |
5G's "network slicing" feature is particularly significant: it allows a separate, invisible network to run on the same physical infrastructure. A government slice could carry surveillance traffic, device exploitation payloads, or IMSI-catcher-equivalent functionality โ and it would be completely invisible to civilian network monitoring tools.
VIII. IoT: Billions of Unpatched Listening Devices
"So-called smart things are set to permeate every aspect of our lives. All things, machines and appliances are being upgraded and reconfigured to be smart. Untold new IoT applications and platforms will herald a new way of life for us all, ushering in a second digital revolution. Somewhat hidden from public view, the IoT has a more sinister side."
"Smart devices can be programmed to share our private information with advertisers over back-channels of which we are not aware. They ensure that Internet-enabled devices are programmed to be quite adept to share information."
The IoT surveillance surface in 2026:
Every IoT device is:
- A potential listening device (smart speakers, TVs, cameras โ always-on microphones)
- A potential proxy node (Bright Data SDK turns TVs into exit nodes โ 039C)
- A potential botnet node (Mirai proved 600K devices compromised in days)
- A potential location beacon (WiFi probe requests, BLE beacons)
- A potential surveillance camera (Ring, Nest, Eufy โ all cloud-connected, all subpoena-able)
IX. The FCC Capture: Who Sets "Safety" Limits?
"The U.S. House Commerce Committee says that the FCC, the U.S. telecoms regulator, is accused of colluding with companies it is supposed to oversee in order to protect a controversial decision over new 5G networks."
"The FCC is a Captured Agency" โ February 2019 report finding that FCC radiation safety standards have not been updated since 1996, despite 25 years of new research including the National Toxicology Program (NTP) finding "clear evidence" of cancer in rats exposed to cell phone radiation.
The IEEE/ICES committee that sets international radiation standards includes US Air Force researcher Dr. B. Jon Klauenberg โ the same military that developed directed energy weapons operates the committee that decides what levels of electromagnetic radiation are "safe."
This is the identical pattern documented in 039B (surveillance market) and 039D (information war): the entity that benefits from the technology also controls the regulatory body that governs it. The FCC regulates telecoms. Telecoms fund FCC commissioners' campaigns and hire them after they leave (revolving door). The safety standards protect industry profitability, not human health.
X. HAARP and Ionospheric Modification
"Located on a United States Air Force site near Gakona, Alaska, the High-frequency Active Auroral Research Project (HAARP) is the world's largest and most functional ionospheric heater and affords us our best view into this field of technology. Construction began in 1993. Today, HAARP can generate super high-powered beams of directed energy."
"HAARP is an exotic weapons system that is part of the weaponization of space, using 'scalar wave interferometry' โ a technology first discovered by scientist Nicola Tesla in the early 1900's. Two or more longitudinal, ultra-low frequency waves are 'aimed' at an intersecting point, at which time they interact in a very unique way, 'tapping' into the limitless background energy of the quantum vacuum."
"U.S. Naval Research Laboratory (NRL) research physicists and engineers from the Plasma Physics Division, working at the High-frequency Active Auroral Research Program (HAARP) transmitter facility, Gakona, Alaska, successfully produced a sustained high density plasma cloud in Earth's upper atmosphere."
This is not contested: the NRL published this result. HAARP demonstrably modifies the ionosphere. The debate is over what else it can do and whether those capabilities have been deployed.
XI. The Convergence: Digital Infrastructure ร Physical Spectrum
| Digital Layer (039A-E) | Physical/EM Layer (039F) | Combined Capability |
|---|---|---|
| Pegasus zero-click exploit (NSO) | IMSI catcher identifies target device | Target selection โ device compromise โ full access |
| Residential proxy network (Bright Data) | IoT device with SDK (smart TV) | Physical device becomes both surveillance endpoint AND proxy node |
| 5G network slicing | Small cells every 100m | Invisible government network covering entire city |
| AI-generated propaganda (039D) | 5G bandwidth enables real-time deepfakes | Synthetic media indistinguishable from reality, delivered instantly |
| Bulletproof hosting (Pfcloud) | C2 for IoT botnet via compromised devices | Millions of cameras/routers as attack platform |
| VPN for attribution avoidance | Directed energy weapon (no digital trace) | Some attacks leave no packets at all โ only RF |
The critical insight: directed energy weapons leave no digital evidence. No logs. No packets. No IP addresses. No HASSH fingerprints. Our honeypot can detect SSH-based attacks because they use TCP/IP. A microwave weapon targeting a diplomat creates no network traffic. This is why the Havana Syndrome investigation has been so difficult โ and why it's the perfect complement to digital operations.
XII. 6G and Beyond: The Total Surveillance Horizon
6G research (targeted for 2030 deployment) includes:
- Terahertz frequencies (100 GHz - 10 THz) โ can image through walls, detect materials, see through clothing
- Integrated sensing and communication (ISAC) โ every base station is simultaneously a radar
- Digital twin cities โ real-time simulation of entire urban environments, tracking every object and person
- Brain-computer interfaces over wireless โ neural link data transmitted via 6G networks
- Sub-centimeter positioning โ locate any device (and its holder) within a few centimeters
This is not speculative โ these are the published research goals of the ITU, 3GPP, and major telecommunications vendors (Samsung, Nokia, Ericsson). Each "improvement" is simultaneously a surveillance capability. Sub-centimeter positioning means tracking every human body. Terahertz imaging means seeing through walls. Integrated sensing means every lamppost is a radar station.
XIII. The Complete Control Stack โ All Layers Named
| Layer | Technology | Control Mechanism | Who Operates It | Documented In |
|---|---|---|---|---|
| 1. Submarine cables | Fiber optic | Bulk SIGINT collection | Five Eyes + Israel | 039A, Snowden archives |
| 2. BGP routing | Internet backbone | Traffic analysis, manipulation | aurologic, transit providers | 038E, 039A |
| 3. Hosting | Servers | C2, malware delivery, propaganda | Pfcloud, Aeza, bulletproof hosts | 038D, 039A |
| 4. Proxy/VPN | Software overlay | Attribution avoidance + monitoring | Kape, Bright Data | 039C, 034B-E |
| 5. Device exploit | Zero-days | Endpoint compromise | NSO, Candiru, Intellexa | 039B |
| 6. IoT/Smart devices | Firmware/SDK | Listening, proxy, botnet | Bright Data SDK, Mirai variants | 039C, 039F |
| 7. Cellular network | 3G/4G/5G | IMSI catch, location, intercept | ISS World vendors, carriers | 039F |
| 8. RF spectrum | Directed energy | Physical attack, no digital trace | State militaries | 039F |
| 9. Ionosphere | HAARP-type heaters | Communications disruption, EMP | US/Russia/China military | 039F |
| 10. Information | AI/social media | Narrative control, consent manufacturing | All state actors | 039D |
Ten layers. Every one documented. Every one weaponized. Every one operated by identifiable entities. The "Ghost Network" isn't just the digital infrastructure we traced from Mishayev through Bavaria to Kentucky. It's the entire electromagnetic spectrum, from ELF (3 Hz) to terahertz (10 THz), from submarine cables to ionospheric heaters.
XIV. What Our Honeypot Represents in This Context
Our Cowrie honeypot observes Layer 3 (hosting/IP attacks). It sees the SSH probes, the credential attempts, the malware delivery. It cannot see:
- IMSI catcher operations targeting phones in our area
- Directed energy probes against our hardware
- 5G network slice operations we're not part of
- Electromagnetic interference below our detection threshold
But what it CAN see is the digital coordination layer for all of the above. Botnet C2 traffic. Proxy verification. Reconnaissance scanning. The digital infrastructure that supports electromagnetic operations must exist somewhere โ and some of it passes through IP networks we can observe.
When we see OMEGATECH hosting 67 C2 servers, some of those servers might coordinate IoT botnets that include compromised cameras with microphones. When we see proxy verification bots testing SSH connectivity, some of those nodes might serve as covert relay stations for directed energy weapon targeting data. We see the support infrastructure. The electromagnetic operations themselves are invisible to our instruments โ but not to this analysis.
"The electromagnetic spectrum is the last commons. It belongs to no one and is used against everyone. Every radio wave that carries your voice also carries your location. Every WiFi packet reveals your device. Every 5G connection enables tracking to the meter. The spectrum was always shared between communication and surveillance โ the difference is that in 2026, the surveillance capability has been commercialized, miniaturized, and sold to anyone with a purchase order.
Our honeypot operates at one layer. This dossier maps ten. The pattern is the same at every layer: dual-use technology, captured regulators, jurisdictional arbitrage, and the commercialization of capabilities that were military secrets twenty years ago. From 8cmร9cm IMSI catchers to ionospheric heaters โ the spectrum is a battlefield. The question is whether you know you're on it."
TI-2026-039F ยท The Electromagnetic Battlefield ยท Letter F
Published by LSN Threat Intelligence ยท June 23, 2026
Sources: ISS World surveillance catalogs, Cambridge Consultants (2011), Altron MTTS/Grabber, "War at the Speed of Light" (Del Monte), "Guinea Pigs: Technologies of Control," "Hidden Dangers 5G" (Flynn), "Mind Wars" (Moreno), "MK-ULTRA: Ritual Abuse," NRL HAARP results, NTP cancer studies, IEEE/ICES papers, LSN OSINT library
Cross-referenced: TI-2026-039A-E (complete series integration)