Dynamic Spectrum Access

For most enterprise IT security teams, network monitoring is heavily focused on traditional wired connections, standard Wi-Fi (2.4 GHz and 5 GHz), and cellular networks. However, the radio frequency (RF) landscape is rapidly evolving, introducing new technologies that can easily bypass standard security perimeters.

In a recent talk, Bob Baxley, Chief Engineer at Bastille, highlighted a fascinating and potentially dangerous RF technology: Dynamic Spectrum Access (DSA). For IT and security professionals, understanding DSA is no longer just a telecommunications niche—it is a critical component of preventing invisible data exfiltration.

The technology travels under several names — dynamic spectrum access, DSA, white space sharing, cognitive radio, spectrum sensing — but they all describe the same class of agile, spectrum-aware device. What follows is how the sharing model works, where the available white space actually is, and why the hardware it produced belongs in your threat model.

Key takeaways

• DSA goes by many names: Dynamic spectrum access, white space sharing, cognitive radio, and spectrum sensing all describe the same basic capability.
• Secondary licensees are a new class of user: They operate in licensed spectrum when the licensee isn’t using it and must vacate immediately when the licensee returns.
• Availability is highly geographic: Databases show open channels by location; dense urban markets have very little white space left.
• The hardware is highly capable: White space radios cover roughly 100–700 MHz and are purpose-built to backhaul bulk data over long distances.
• A real exfiltration path: Operating well outside the range of traditional WIPS (Wireless Intrusion Prevention Systems), these devices present a massive invisible risk.
• Wireless microphones share this spectrum: Corporate and event microphones also utilize these gaps, presenting their own security and monitoring concerns.

What dynamic spectrum access changes

Dynamic Spectrum Access is a class of radio technology that lets devices operate opportunistically in spectrum they don’t own. It travels under several names—dynamic spectrum access, white space sharing, cognitive radio, and spectrum sensing—but the underlying model is the same.

Traditional spectrum policy recognizes two groups:

1. Licensed users who paid for exclusive access to a band (like TV broadcasters).
2. Unlicensed users confined to specific shared bands like 2.4 GHz and 5 GHz (like Wi-Fi routers).

DSA introduces a third group: secondary users. When a licensee isn’t actively transmitting, the FCC permits secondary devices to move into that licensed spectrum and use it.

The agility requirement, and how it’s managed

The tradeoff for this access is agility. A secondary device has to know when the primary licensee is present—through spectrum sensing, a geolocation database lookup, or both—and it must vacate the channel the exact moment the licensee returns. Availability is therefore a function of both location and frequency, and it changes as the incumbent picture changes.

In the talk, Baxley walks through Google’s white space database interface, which maps out exactly where secondary users are permitted to operate. Two views drive the point home:

1. A geographic map showing where white space operation is allowed, alongside a photo of a commercially available white space sharing radio.
2. A channel occupancy chart plotting TV channels across the x-axis against the TV stations in use on the y-axis.

In densely populated markets like Georgia, nearly every TV channel is occupied—only a handful at the edges show as “green” and available. Densely populated markets simply don’t have much white space to share. Interestingly, one of the available channels in that view is specifically allocated to wireless microphones, adding another layer to the RF monitoring challenge.

Why this matters to security teams

The security concern isn’t the sharing model itself—it’s the powerful hardware it has produced. The AWR white space sharing radio shown above operates roughly from 100 MHz to 700 MHz, the range that used to carry analog television. It was designed to backhaul large volumes of data, including high-definition video, over multiple kilometers.

That combination creates a massive blind spot. Most enterprise wireless monitoring is aimed strictly at Wi-Fi, Bluetooth, and cellular. A DSA radio sitting in the former analog TV bands is:

• Outside your standard visibility range. If your security tooling stops at the standard ISM (Industrial, Scientific, and Medical) bands, this traffic is entirely invisible.
• Built for massive volume. These radios exist specifically to move video and bulk data reliably, which is the exact profile of a large data exfiltration event.
• Long-range. Because these lower frequencies penetrate concrete easily and travel well, multi-kilometer links mean the receiving end doesn’t have to be anywhere near your physical perimeter, your parking lot, or your fence line.
• Legal to operate. Nothing about procuring or deploying one of these devices is inherently suspicious, meaning standard physical security and procurement controls are unlikely to flag it.

Data exfiltration doesn’t have to cross your corporate firewall. If you can’t see the 100–700 MHz spectrum, you can’t definitively rule out that an exfiltration event isn’t already happening right through your walls.

The band, in brief

Under FCC rules, TV white space devices operate opportunistically on unused channels in the broadcast television bands:

• VHF: 54–72 MHz, 76–88 MHz, and 174–216 MHz
• UHF: 470–698 MHz
• Plus portions of the repurposed 600 MHz band.

Fixed and portable devices are required to consult an FCC-designated database to receive a dynamic list of channels that are legally available at their specific geographic coordinates.

Full Transcript

Hi. Welcome to this talk on dynamic spectrum access. My name is Bob Baxley, I’m the chief engineer at Bastille, where I run the data science and radio teams.

Many names for one idea

So dynamic spectrum access is this fairly new technology that’s really, really interesting, especially if you’re an IT security person. And before we dig into it, I want to say it’s known by several different names. So dynamic spectrum access is one name. White space sharing is another name. Cognitive radio is another name. Spectrum sensing is another name. So there’s all these names that describe basically a class of devices.

Secondary licensees

And the idea in those schemes is that instead of having just licensed users and unlicensed users, we have the ability to have secondary licensees. So in spectrum that a licensed user has licensed and paid for, if they’re not using it, the FCC has allowed secondary users to come in and use the spectrum. And those secondary users have to be agile. They have to be able to sense the spectrum and understand if there’s a licensed user there. And once the licensed user comes back on, the unlicensed secondary user has to get off the air.

Mapping available white space

So I’ve got a plot here of Georgia, and Google actually maintains a database of where secondary users can operate both in space and in frequency. It’s a pretty new plot. And on all inside into that plot, I have a picture of an AWR white space sharing radio.

And this is where it gets interesting if you’re an IT security person, because that radio is able to operate from one hundred megahertz to seven hundred megahertz. This is where all the old analog TV bands were. And that radio is made to backhaul large amounts of data. It’s made to backhaul video and those sorts of things, multiple kilometers. So if you’re worried about data exfiltration events, you need to really have an eye on this spectrum that used to be where the analog TVs operated.

This next plot is another screenshot from that same Google interface, and it shows you across the top of the frequencies the TV channels. And across on the y axis are all the TV stations that are in use. So you can see here in Georgia, almost all the channels are occupied. And there’s a few channels on the edges in the green that are not occupied. So here in Georgia, there’s not many white space sharing frequencies available.

If you stare closely, one of those channels is actually allocated for these wireless microphones. And we’ll look at that in real time on the spectrum in a later talk.

So thanks for listening. Again, my name is Bob Baxley. See you next time.