Encryption has become the default answer to protecting sensitive communications. Modern protocols can provide strong confidentiality and integrity, making it increasingly difficult for an adversary to intercept and read information moving across a network.

But encryption does not make communications invisible.

Even when the contents of a message are protected, the act of communicating generates information. Packet sizes, transmission timing, traffic volumes, connection patterns and network destinations can all reveal something about the systems and people involved. Collectively, these observations can provide an adversary with a surprisingly detailed understanding of an organisation's activities.

For defence and intelligence organisations, the distinction between protecting information and concealing activity is particularly important.

What the network gives away #

Consider a military unit operating across a distributed communications network. Its personnel and equipment exchange encrypted messages, telemetry and operational data. An adversary monitoring the network cannot read those messages, but may still be able to observe when devices communicate, how frequently they exchange information and how those patterns change over time.

A sudden increase in traffic between particular nodes might indicate preparations for an operation. Regular exchanges between a small number of systems could suggest a command relationship. Periodic transmissions might reveal the presence of an unattended sensor, while changes in transmission frequency could indicate that a previously inactive system has become operational.

None of these observations requires the adversary to defeat the encryption protecting the traffic.

The problem extends beyond individual connections. With sufficient observations, traffic analysis can reveal patterns of behaviour that would otherwise remain concealed. Relationships between systems, operational routines and changes in activity can sometimes be inferred from metadata alone.

This is not a new intelligence discipline. Traffic analysis has been used for decades, including against communications systems whose contents could not be readily decrypted. What has changed is the volume of information generated by modern connected systems and the opportunities available to collect and correlate it.

As defence organisations deploy larger numbers of connected devices, the potential intelligence value of their network activity grows alongside them.

Encryption solves a different problem #

Modern encryption is remarkably effective at protecting the contents of communications. Properly implemented, it prevents an observer from recovering the information exchanged between endpoints without access to the relevant keys.

However, the properties that allow networks to function also create opportunities for observation.

Packets must be transmitted, addressed and delivered. Network equipment needs enough information to move traffic towards its destination. Devices generate recognisable patterns as they establish connections, exchange data and maintain sessions.

Even where addressing information is concealed within an encrypted overlay, an observer may still see the outer transport, the timing and volume of transmissions, and the infrastructure carrying them.

This creates a distinction between content confidentiality and communications confidentiality. Protecting the information within a message does not necessarily protect the fact that the message was sent, the relationship between its participants or the circumstances surrounding its transmission.

The distinction matters because operational security requirements frequently extend beyond the contents of individual messages.

An adversary may have little interest in reading a particular telemetry update if its transmission reveals that a previously dormant system has become active.

The limits of traffic obfuscation #

There are techniques for reducing the information exposed by network activity, but each introduces its own compromises.

Padding can make messages less distinguishable by size. Cover traffic can obscure periods of genuine activity by introducing additional transmissions. Batching and deliberate delays can reduce the precision with which an observer associates individual events with network activity.

Other approaches attempt to make communications less predictable by varying transmission intervals, changing routes or reducing the consistency of observable traffic patterns.

These techniques can complicate traffic analysis, but they are not without cost.

Additional transmissions consume bandwidth and power. Deliberately delaying traffic increases latency. Routing traffic through additional intermediaries can introduce complexity and reduce performance. Some techniques that work well on high-capacity terrestrial networks become impractical when communications depend on constrained radio links or battery-powered equipment.

There is also a fundamental limitation: disguising individual packets does not necessarily conceal the broader behaviour of a network. An adversary collecting observations over an extended period may still identify patterns, particularly when network activity can be correlated with other sources of intelligence.

Traffic obfuscation should therefore be understood as a means of reducing observable information rather than guaranteeing anonymity or invisibility.

Its effectiveness depends on the adversary's collection capabilities, the characteristics of the underlying network and the operational constraints of the systems being protected.

Designing for the observable network #

These considerations become especially important at the tactical edge.

A conventional enterprise network may have sufficient bandwidth and computing resources to accommodate additional security measures with relatively little operational impact. A small unmanned system communicating over a constrained radio link faces a very different set of trade-offs.

Bandwidth, power consumption, latency and transmission opportunities may all be tightly limited. Introducing unnecessary traffic to disguise legitimate communications could undermine the system's ability to perform its primary function.

In these environments, reducing the information exposed by communications requires a more deliberate approach.

Applications should avoid transmitting unnecessary information. Telemetry can be prioritised according to operational importance, with less urgent data buffered until suitable transmission opportunities arise. Communications systems can be designed to accommodate periods of radio silence and recover gracefully when connectivity returns.

Where appropriate, transmission behaviour can also be made less predictable, although the effectiveness of such measures must be assessed against the capabilities of the adversary and the requirements of the mission.

These decisions cannot be made entirely within the encryption layer. They require coordination between applications, networking software and the underlying communications equipment.

A system designed to transmit continuously will remain conspicuous regardless of how effectively its traffic is encrypted. Conversely, a system that minimises unnecessary communications may reduce its observable footprint while also conserving bandwidth and power.

The challenge is determining which information must move, when it must move and what an observer can learn from that activity.

Security beyond the payload #

At Sirius, we are interested in how secure communications can operate effectively across environments where connectivity, bandwidth and exposure to observation cannot be taken for granted.

Our work on Crux addresses the protection and management of communications across heterogeneous devices and networks. As we extend these capabilities into more constrained environments, the relationship between encryption, traffic management and observable network behaviour becomes increasingly important.

Strong encryption remains essential. It protects information against interception and provides a foundation for trusted communications. But it should not be mistaken for a complete solution to the intelligence risks associated with network activity.

For organisations operating in contested environments, the question is no longer limited to whether an adversary can read their communications. It must also include what that adversary can learn simply by watching them.

A network carries information, but it also produces information about itself. Both deserve protection.