THE INTEL ANALYST ACADEMY
Professional Intelligence Training
Printable Lesson
Sigint Basics
The Intel Analyst Academy · Lesson Notes
Signals Intelligence - SIGINT - is the discipline of collecting and analysing electronic signals to produce actionable intelligence. It is the largest technical collection discipline in the intelligence community, responsible for the majority of raw intelligence volume in most Western agencies. From the crackle of a shortwave radio in the South China Sea to the encrypted packets flying across a terrorist network's VPN, SIGINT captures it all - provided you have the right antenna, the right algorithm, and the right legal authorisation.
In this lesson, you will learn to navigate the alphabet soup of SIGINT sub-disciplines, understand how signals are actually collected in the physical and digital worlds, grapple with the eternal tug-of-war between cryptographers and codebreakers, and study the historical moments - both glorious and catastrophic - that define the SIGINT profession.
A word of warning before we begin: SIGINT analysts have a reputation for being technically brilliant and socially ambidextrous only with machines. If you find yourself explaining frequency-hopping spread spectrum at a cocktail party, you may already be one of us.
SIGINT is not a monolith. It breaks down into three primary sub-disciplines, each targeting a different flavour of electromagnetic emission. Knowing which one you are working in determines everything from your collection platform to your legal framework to the kind of analyst who will read your report.
COMINT is the interception of communications between parties - voice calls, text messages, emails, video conferences, radio transmissions. It is what most people imagine when they hear "signals intelligence." COMINT targets the content of the communication as well as the metadata: who called whom, when, for how long, and from where.
The legal and policy constraints on COMINT are the most stringent of all SIGINT sub-disciplines because it involves intercepting the private communications of individuals - including, potentially, your own citizens. Every Western intelligence service has elaborate oversight mechanisms, warrant processes, and minimization procedures to ensure COMINT collection stays within legal bounds. The joke among analysts is that for every hour spent intercepting a signal, you spend three hours filling out the paperwork to justify it.
COMINT analyst motto: "I heard that. Yes, that too. No, I will not tell you where I hid the recording."
ELINT is the interception and analysis of non-communications electronic emissions - primarily radar signals, but also telemetry, beacons, navigation systems, and electronic warfare emissions. Unlike COMINT, ELINT rarely targets the "meaning" of a signal in a human sense. Instead, it targets the technical characteristics of the emitter itself: frequency, pulse repetition interval, scan pattern, power output.
ELINT is how we know what radar system an adversary is using, where it is located, what it can detect, and - crucially - how to jam it. ELINT analysts maintain libraries of "electronic signatures" for every known radar system in the world, from the air defence radars on a destroyer to the weather radar on a civilian airliner. When a new, unknown signal appears, it gets a technical description, a nickname, and a place on the "watch list."
The best ELINT analysts develop a "musical ear" for signals. They can identify a radar type by its pulse repetition frequency the way a musician identifies a song by its opening notes. Train yourself by listening to recorded signal samples - your brain will learn the patterns faster than you expect.
FISINT is the niche specialist of the SIGINT family. It targets the telemetry, tracking, and command signals from foreign weapons systems, satellites, missiles, and other instrumentation. When a nation tests an intercontinental ballistic missile, the telemetry stream from that missile - reporting engine temperature, velocity, altitude, and course corrections - is a FISINT target.
FISINT played a starring role during the Cold War, where US and Soviet analysts pored over each other's missile telemetry to determine capabilities, readiness, and whether the other side was cheating on arms control treaties. It remains a critical discipline for monitoring North Korean and Iranian missile development today.
At a Glance: The Three SIGINT Pillars
There is a persistent myth that SIGINT is a matter of pointing a big antenna at the sky and "recording everything." In reality, signal collection is a staggeringly complex logistical, technical, and operational challenge shaped by physics, geography, and the adversary's countermeasures.
SIGINT collection happens from every conceivable platform. Ground stations - known as "fixed sites" - dot the globe, often disguised as innocent telecommunications facilities. Aircraft configured as SIGINT platforms, such as the US RC-135 Rivet Joint or the UK's RC-135W Airseeker, orbit in international airspace, scooping up signals from hundreds of kilometres away. Ships - intelligence vessels known as "spy ships" - loiter off coastlines, their masts bristling with antennas. Satellites in geosynchronous, Molniya, and low-Earth orbits provide global coverage, though at a cost of billions per platform.
Then there are the less glamorous platforms: modified shipping containers placed on rooftops at embassies, drones that loiter for 24 hours above a target area, and - increasingly - software-defined radios hidden in consumer devices that can be remotely activated to listen to nearby signals. The SIGINT collector of the 21st century is as likely to be a hacked smartphone as a satellite.
The most expensive SIGINT collection platform ever built? The US Navy spent roughly $27 billion on a single class of spy ships. Or, as the Chief would say, "That is a lot of money for a boat that just sits there and listens."
Signal collection is fundamentally constrained by physics. Signals weaken with distance according to the inverse square law. They bounce off the ionosphere, scatter off buildings, and get absorbed by rain. A signal that is perfectly readable at one kilometre may be indistinguishable from noise at ten. This is why collection platforms must be positioned carefully - you cannot just "zoom in" on a signal the way you can zoom a camera.
Adversaries know this. They use directional antennas to confine their signals, frequency-hopping spread spectrum to dart across the band, burst transmissions that compress minutes of data into milliseconds, and low-probability-of-intercept (LPI) waveforms designed to look like noise. The SIGINT analyst's job is to catch the signal anyway - a game of technological cat-and-mouse that has been running since World War I.
Always ask three questions when planning a SIGINT collection: "What is the expected signal strength at the collector?" "What is the noise floor in that environment?" "What countermeasures is the target using?" If you cannot answer all three, you are guessing - and guessing in SIGINT gets people killed.
SIGINT without cryptanalysis is just eavesdropping on conversations the target is happy for you to hear. The moment a target encrypts their communications - and virtually every serious target does - the SIGINT analyst must either break the encryption or find another way in. This has spawned a decades-long conflict between those who build cryptographic systems and those who try to defeat them.
Every major advance in cryptography has been met by an equal or greater advance in cryptanalysis. The Enigma machine was broken by Alan Turing and his colleagues at Bletchley Park - the single greatest SIGINT triumph of World War II. But Enigma was a mechanical system; modern encryption is mathematical, and much harder to break.
Today, the encryption debate has moved into the public square. Technology companies deploy end-to-end encryption by default, making it impossible for even the platform provider to read users' messages. Intelligence agencies argue that this creates "going dark" - spaces where terrorists, criminals, and hostile states can communicate without fear of interception. Privacy advocates argue that weakening encryption for law enforcement weakens it for everyone.
The SIGINT analyst's reality is more nuanced. In practice, encryption is rarely broken through mathematical genius alone. It is broken through implementation flaws, side-channel attacks, compromised devices, human error, and - most commonly - metadata analysis. You may not be able to read the encrypted message, but you know who sent it, when, from where, and to whom. Sometimes that is enough.
Encryption is like a combination lock. The mathematician tries to calculate the combination. The SIGINT analyst just asks the guy who set the lock what the combination is, then buys him a beer.
It is critical to understand that the relationship between SIGINT and cryptography is not purely adversarial. SIGINT agencies are also among the world's largest employers of cryptographers. The NSA, GCHQ, and their counterparts build cryptographic systems to protect their own communications - and they employ some of the finest mathematicians on the planet to do so. The SIGINT professional lives in both worlds: breaking other people's codes while securing their own.
This dual role creates interesting tensions. When a vulnerability is discovered in a widely used encryption standard, the intelligence agency faces a choice: disclose the vulnerability so it gets fixed (protecting everyone, including your own systems) or keep it secret so you can exploit it for collection (protecting your operational capability). This is known as the "Vulnerability Equities Process," and it is one of the most sensitive policy debates in the SIGINT world.
Never assume you have broken a target's encryption. Assume they have let you break it. The most sophisticated counterintelligence operation in SIGINT history involved feeding an adversary encrypted traffic with a deliberate weakness - and watching them build intelligence on the lies they swallowed.
Some of the greatest victories - and most devastating failures - in intelligence history are SIGINT stories. They teach us what the discipline can achieve when it works perfectly, and what happens when it breaks down.
The classic SIGINT victory. US Navy cryptanalysts, led by Commander Joseph Rochefort at Station HYPO in Hawaii, had partially broken the Japanese Navy's JN-25 code. When Japanese radio traffic began referring to an upcoming operation against target "AF," Rochefort suspected AF was Midway Atoll. To confirm, he had the US garrison at Midway send a fake message that their freshwater condenser had broken. Within hours, Japanese signals reported that "AF" was low on fresh water.
This single SIGINT coup allowed Admiral Nimitz to position his outnumbered carrier force exactly where the Japanese fleet would arrive. The result was the sinking of four Japanese carriers and the turning point of the Pacific War. Rochefort's work remains the textbook example of how SIGINT can change the course of history.
Rochefort's trick - faking a broken water condenser to confirm the target - is still taught as the original SIGINT "confirm or deny" operation. Modern analysts call it "the Midway gambit." Their managers call it "creative tradecraft." Lawyers call it "I have some questions."
The Venona Project was a US counterintelligence programme that decrypted Soviet diplomatic traffic from the 1940s. It ran for 37 years - entirely in secret. The decrypted messages revealed a vast Soviet espionage network inside the US government, including atomic spies Klaus Fuchs, Julius and Ethel Rosenberg, and a ring of influence agents in the State Department and Treasury.
Venona succeeded because the Soviets made a critical mistake: they reused one-time pads, the only theoretically unbreakable encryption system. Analysts at the Army Security Agency noticed statistical anomalies in the Soviet traffic and spent years painstakingly reconstructing parts of the code. Venona was never mentioned in any public document until 1995 - proof of the operational security that surrounds successful SIGINT programmes.
Not every SIGINT story is a triumph. In 2005, the New York Times revealed that the NSA, operating from Room 641A in a San Francisco AT&T building, had been intercepting the domestic communications of millions of Americans without warrants. The programme - authorised secretly by the Bush administration after 9/11 - routed a copy of all internet traffic passing through that facility through NSA collection systems.
The fallout was catastrophic for the intelligence community's public trust. Lawsuits, Congressional investigations, and a permanent taint on the NSA's reputation followed. The lesson for SIGINT professionals is brutal but essential: legal authority is not optional. The best SIGINT in the world is worthless - worse, destructive - if it was collected illegally. A SIGINT analyst must know not only how to intercept a signal, but whether they have the legal right to do so.
Study the histories. Midway teaches you tradecraft. Venona teaches you patience. Room 641A teaches you that no collection is worth the loss of your agency's credibility. Every SIGINT professional should know all three stories cold.
You are a SIGINT analyst assigned to a Joint Intelligence Centre. A friendly signals unit has provided you with a log of unusual radio emissions detected on an island chain in the South China Sea over the past 72 hours.
Your task: Based on what you have learned in this lesson, write a short intelligence note (no more than 200 words) that:
Hint: Start by separating communications signals from non-communications signals. The radar emissions are ELINT; the encrypted voice channels are COMINT. A missile telemetry burst would be FISINT - but do you have the platform to catch it?
Continue your training
This lesson is part of The Intel Analyst Academy — professional intelligence analysis training built for analysts. Explore the full course library, structured learning paths, and practical tools at theintelanalystacademy.com.
