Radio Frequencies and Regulations

The electromagnetic spectrum runs from zero hertz to well past visible light — RF engineers describe the useful part of it as “DC to daylight.” But for an IT security team, almost none of that range matters. What matters is the slice where the communicators in your environment actually live, and who is legally allowed to operate there.

In this talk, Bastille Chief Engineer Dr. Bob Baxley narrows the spectrum down to the band that enterprise security teams need situational awareness into, then explains the regulatory structure that governs it: licensed bands that carriers pay billions of dollars for, and unlicensed bands where anyone — including an attacker — can transmit without asking permission.

That distinction has direct security consequences. The bands where Wi-Fi, Bluetooth, and most consumer and IoT devices operate are precisely the bands with the lowest barrier to entry for a rogue transmitter.

Key takeaways

• “DC to daylight” describes the whole playing field: from zero hertz up through roughly 10¹⁴ Hz, with X-rays and gamma rays above that — a huge range, most of which is irrelevant to enterprise security.
• The band that matters is roughly 60 MHz to 50 GHz: the vast majority of wireless communication in a corporate environment happens there.
• 2.4 GHz is only one sliver: wireless microphones near 700 MHz, key fobs near 300 MHz, other peripherals near 400 MHz, and laptops at 2.4 and 5.8 GHz all coexist in the same building.
• The FCC allocates U.S. spectrum: it set aside specific unlicensed bands, and licenses nearly everything else to paying operators.
• Unlicensed bands need no permission to use: which is why Wi-Fi and countless consumer devices live there — and why an unauthorized device can appear in them without any regulatory friction.
• Licensed bands come with enforcement: a licensee can ask the FCC to investigate an unauthorized emitter, and fines for operating in licensed spectrum can reach millions of dollars.
• Spectrum is expensive: priced in dollars per MHz-pop, recent auctions have run as high as roughly $2 per MHz-pop — hundreds of millions of dollars for a modest allocation in a single state.
• Higher bands are coming: 10–100 GHz, including 5G proposals in the 20 GHz range, will carry more traffic over the next decade, extending the range security teams must eventually cover.

From “DC to daylight” to the band you actually care about

Plot the electromagnetic spectrum end to end and it spans from zero hertz up to exahertz frequencies. In radio circles, “DC to daylight” is shorthand for pretty much any electromagnetic frequency you might care about: DC means zero, and daylight sits around 10¹⁴ Hz. Above daylight are X-rays and gamma rays.

For an IT security person, though, the interesting question is much narrower: where in the spectrum are the communicators in your environment operating? Most people are familiar with 2.4 GHz because Wi-Fi and Bluetooth live there, but that’s a single sliver. Walk through a typical office and the transmitters around you are spread out:

• ~300 MHz — key fobs and remote controls
• ~400 MHz — assorted wireless peripherals and remotes
• ~700 MHz — wireless microphones
• 2.4 GHz and 5.8 GHz — laptops, phones, Wi-Fi, Bluetooth, and a long tail of IoT devices

Put all of that together and the practical monitoring range is 60 MHz to 50 GHz. That’s where the vast majority of wireless communication happens, and that’s the range an enterprise needs situational awareness into.

What’s coming next

Over the next decade, more signals will appear in the higher bands — 10 GHz to 100 GHz. 5G proposals target the 20 GHz range, and a great deal of radar already operates up there. Wide deployment of those higher-frequency communication systems is still some years out, but the trend line is clear: the band that security teams need to watch keeps getting wider.

Licensed versus unlicensed spectrum

In the United States, the FCC decides who is allowed to use which frequencies. Long ago it set aside certain frequencies as unlicensed bands — 2.4 GHz being the most familiar. In those bands you don’t need a license to operate, which is exactly why Wi-Fi and so many consumer devices ended up there.

Almost everything else is licensed. To operate in licensed spectrum, you pay the FCC for the right to use it, and once you have, you can restrict everyone else from using it.

Enforcement is real

When a carrier like T-Mobile buys a sliver of spectrum to serve its cell phone customers and then detects another emitter operating in that spectrum, it can ask the FCC to investigate. If the FCC determines that you have been transmitting in spectrum licensed to someone else, the penalty can run into the millions — a $10 million fine is not out of the question.

The fines are steep because the licenses are expensive. Carriers spend billions of dollars licensing spectrum from the FCC, and the enforcement regime protects that investment.

How spectrum is priced: MHz-pop

Spectrum is licensed in units of MHz-pop — megahertz multiplied by the population covered. The arithmetic is straightforward:

• Georgia has roughly 10 million people.
• Licensing 10 MHz of spectrum across that population for $100 million works out to $1 per MHz-pop.
• More recent auctions have gone as high as roughly $2 per MHz-pop — meaning the same 10 MHz across Georgia would cost about $200 million.

Multiply that across every market a national carrier serves and the billions add up quickly.

Why the licensing model matters for security

The regulatory split explains a great deal about the wireless threat landscape. Licensed bands are policed — commercially and legally — by the operators who paid for them. Unlicensed bands have no such guardian. Anyone can transmit in 2.4 GHz, which is what makes Wi-Fi possible and equally what makes a rogue access point, a hidden hotspot, or a wireless keystroke injector trivially deployable.

At the same time, an attacker willing to break the rules can operate in licensed bands too — a rogue cell tower, for instance, transmits in spectrum licensed to a carrier. The FCC’s enforcement process is slow and reactive by design; it is not a control an enterprise can rely on to detect a device operating inside its own facility this afternoon.

That’s the argument for monitoring the full 60 MHz to 50 GHz range directly: regulation determines who is supposed to be transmitting where, but only observation tells you what is actually transmitting in your space.

Full Transcript

Hi, welcome to this talk on radio frequencies and regulations. My name’s Bob Baxley, and I’m the Chief Engineer at Bastille, where I run the radio and data science teams. In this talk, I want to give you a feeling about the electromagnetic spectrum.

DC to daylight

You can see in this plot that we go from zero hertz all the way up to exahertz. In radio frequency circles you often hear terms like “DC to daylight” — that’s used to describe pretty much any electromagnetic frequency you might care about. DC means zero; daylight is around 10 to the 14th hertz. But above daylight you have X-rays and gamma rays, so it’s a huge spectrum of possible frequencies.

Where the communicators are

If you’re an IT security person, what you really care about are the communicators in your environment. You care about where in the spectrum wireless communications are happening. I’m sure you’re familiar with all the devices that communicate at 2.4 gigahertz, but that’s just one sliver where communicators operate. This microphone is at 700 megahertz, this key fob is at 300 megahertz, and this is at 400 megahertz. Your laptop is at 2.4 and 5.8 gigahertz.

So if you put all that together, we’re really talking about the range from 60 megahertz to 50 gigahertz. That’s where the vast majority of wireless communications happen, and that’s where, if you’re an IT security person, you want situational awareness into what’s going on in that spectrum.

In the next decade or so, we’ll see more signals in the next higher bands, from 10 gigahertz to 100 gigahertz. That’s where the proposals for 5G are, in the 20 gigahertz range. It’s also where a lot of radars operate. But I wouldn’t worry about that now — that’s probably a decade off before any of those higher frequency communication systems are really widely deployed.

Licensed and unlicensed bands

So we have this huge spectrum. In the United States, the organization that licenses who gets to use which spectrum is called the FCC. A long time ago, the FCC set aside certain frequencies as unlicensed bands, and those are ones you’re probably familiar with, like 2.4 gigahertz. In that spectrum you don’t have to have a license to operate, and that’s why Wi-Fi and other devices operate in those frequencies.

On the other hand, there are the licensed bands. Almost all the other bands are licensed, and for those bands you have to pay the FCC for the right to license that spectrum. Once you have made that payment, you have the right to restrict any other users from using that spectrum.

For instance, when T-Mobile buys a sliver of spectrum so that they can service cell phones, if they catch another emitter on that spectrum, they’ll ask the FCC to investigate. If the FCC finds out that you’ve done that, it can be a $10 million fine for operating in spectrum that isn’t licensed to you.

What spectrum costs

The reason the fines are so steep is because it costs the T-Mobiles of the world a lot of money to license spectrum from the FCC. We’re talking about billions and billions of dollars to license spectrum.

Spectrum is licensed in these units called megahertz-pop. In Georgia there are 10 million people. If you were to license 10 megahertz of spectrum for $100 million, that would be one dollar per megahertz-pop, and more recent auctions have gone as high as two dollars per megahertz-pop. In that case it would cost you $200 million to buy 10 megahertz of spectrum for all the users in Georgia.

Again, I’m Bob Baxley with Bastille. Thanks for listening.