[walrus01]

My job overlaps with microwave and millimeter wave RF engineering somewhat. R&S also has no qualms about selling high-end spectrum analysis equipment to authoritarian regimes. Probably done through middlemen. For instance, you can find the Iranian government using their equipment in Tehran to hunt down things they don't like.

To be fair, there's probably less than ten manufacturers of their category of spectrum analysis gear (for commercial/non-military use) in the world, and their stuff is top quality.

[tyingq]

Interesting, so triangulating people forwarding "open" internet over consumer-grade microwave (like Ubiquiti or similar)?

I assume they can't do much about Toosheh since it's "read only", multiplexed with legitimate TV channels on the same transponder, and uplinked from the UAE.

[walrus01]

Things that transmit generally, in all sorts of bands, lots of countries where the government holds an armed monopoly on connections to the outside world.

Try setting up an independent two-way satellite based C or Ku band earth station in Ethiopia, offer service to your neighbours and armed men will come to dismantle it.

Commercial spectrum analysis tools are an essential and important things in the hands of network engineers, but also a tool to crack down on anything that transmits that an authoritarian regime doesn't like.

[myself248]

Not with perfect accuracy, but the local oscillator of a receiver (which is mixed with the signal from the antenna to produce an intermediate frequency which is further processed) leaks back out the antenna a little bit.

In the case of an FM radio, this means you can tell what station a given receiver is tuned to, if you make certain assumptions about common LO/IF frequencies. There was a company monetizing this called "Mobiltrak", but I haven't seen much about them lately.

In the satellite case, there's the IF of the LNB itself, which leaks fairly loudly out the feedhorn, but it only tells you which band they're tuned to. There's likely a second IF used in the IRD, which should be much fainter from outside, but if you could recover that, you could tell which transponder is being demodulated.

That still wouldn't tell you if the Toosheh packets are being saved, but if the program they're muxed with isn't particularly popular, it would be a strong hint.