Force Protection

Disclaimer
This document is provided as an illustrative example of a force-protection baseline report using anonymized wireless-survey data. It does not reflect real-world operations or specific tactics and serves solely for demonstration purposes.

Executive Summary

Survey teams conducted detailed wireless surveys covering an area extending three to five kilometers around the target location capturing comprehensive data on Wi-Fi, Bluetooth Classic, Bluetooth Low Energy (BLE), and cellular signals. The surveys established a clear baseline of normal wireless activity that includes device counts, vendor presence, expected signal strengths, and common transmission patterns.

In the Wi-Fi spectrum, analysts identified over 1,200 unique SSIDs with the majority secured using current encryption standards. Signal strengths typically ranged from –60 to –55 dBm, indicating devices positioned about 25-30 meters from survey points. Bluetooth Classic devices (primarily smartphones and vehicle hands-free systems) showed distinct activity spikes during morning and evening commuting hours. Average signal strengths are around –40 dBm, corresponding to roughly 15 meters distance. BLE signals were notably widespread, with over 1,000 unique beacons detected. Approximately half of these devices broadcast identifiable vendor information which includes consumer smartwatches and IoT tags. The remainder employed randomized or hidden identifiers. This is typical of both consumer privacy practices and potential operational devices. Cellular signals, comprising LTE and WCDMA transmissions, includes roughly 260 unique cell sites. All are verified as legitimate carrier installations. Cellular signals exhibited strengths between -85 and -75 dBm, characteristic of standard urban network deployments, broadcasting strengths of several hundred meters.

This report details normal operational parameters of the surveyed wireless environment. Additionally, it identifies criteria for recognizing abnormal or suspicious wireless signals, empowering analysts and force-protection personnel to detect and investigate potential threats.

The Wi-Fi Landscape

The survey of wireless signals in the local environment discovered a mix of commercial and enterprise Wi-Fi networks. Over 53,000 individual detections translated into 1,230 distinct SSIDs, with more than 90 percent provided by three major carriers.

• Carrier A’s hotspots appeared throughout residential neighborhoods and local shopping districts.
• Carrier B’s networks clustered along main transit routes.
• Carrier C’s coverage centered on plazas and community centers.
• A small number of business-style SSIDs surfaced in light-industrial parks, logistics hubs, and office campuses.

In terms of signal strength:

• Most routers peaked between -65 and -55 dBm, placing them about 25-30 meters from survey points.
• The median reading of -60 dBm corresponds to 40 meters.
• Fewer than five percent of networks were below -75 dBm, suggesting those were at the very edge of the survey area (around 100-150 meters away).

Notably, every network detected above -70 dBm required encryption. No open SSIDs exceeded that level. Brief guest-mode signals did appear around -80 dBm, but they faded well before reaching heavily trafficked areas, posing minimal risk. This uniform use of encryption reflects disciplined configuration practices among local operators and sets a clear benchmark for identifying any future unsecured networks.

Bluetooth Classic Activity

Over 7,400 Bluetooth Classic transmissions were recorded in the survey area, revealing clear patterns tied to daily travel. Activity spiked from 6 to 9 a.m. and again from 5 to 8 p.m., matching rush-hour traffic along the main corridor.

A closer look at device origins shows:

• 45% came from smartphones
• 35% from in-car hands-free and infotainment systems
• 20% from aftermarket audio or specialty streaming devices

Signal-strength readings averaged -40 dBm, placing most devices about 15 meters away from survey sensors. Individual measurements ranged from -33 dBm (3-5 meters, ideal for pairing) down to -50 dBm (around 50 meters, typical curbside range).

The standard profile for Bluetooth Classic in this area is:

• Broadcast sessions limited to commute windows
• Signal peaks seldom stronger than -33 dBm, except when devices are very close
• Durations normally under 30 minutes once a device arrives in view

Any Bluetooth transmission that lasts beyond those commute periods, remains at high strength for extended periods, or appears in off-peak hours would be considered outside the expected baseline.

BLE Beacon Landscape

Bluetooth Low Energy (BLE) dominated the wireless landscape, with 9,386 broadcasts detected from 1,094 distinct devices. About 45% carried recognizable names, predominantly smartwatches and consumer IoT tags. The rest used randomized or hidden addresses, a mix of everyday gadgets and specialized equipment.

Key observations include:

• Named Devices
  • A popular smartwatch model consistently appeared in clusters around residential areas and parks.
  • Voice-assistant speakers showed up in commercial districts (cafes and lounges).
  • Transit related IoT tags, mounted on benches and signage, emitted brief bursts every 2-5 seconds.
• Signal Strength Patterns
  • The main signal concentration hovered around -60 dBm, roughly 25 meters away.
  • A secondary peak at -40 dBm indicated devices within 10 meters of the survey route.
  • The strongest single reading, -33 dBm, signaled a beacon sitting within one to two meters of the detector.
• Baseline Behavior
  • Beacons broadcast at regular and  predictable intervals and disappear quickly as people move on.
  • Hidden or randomized MAC addresses averaged 20-30 per waypoint during each survey.
  • Any location showing more than 60 hidden-device broadcasts in a single pass suggests an unusually dense deployment and deserves further review.

These findings establish a reliable reference for BLE activity in the area, allowing security teams to spot irregular concentrations or excessively strong signals. Both are potential indicators of unauthorized or covert employment of BLE devices and infrastructure.

Cellular Infrastructure Assessment

Cellular activity in the area was consistent with licensed carrier networks. Analysts logged 1,865 events across LTE and WCDMA, representing 257 unique cell IDs serving both macro sites and a dense layer of small-cell repeaters. Typical signal levels fell between -85 and -75 dBm. At those strengths, small cells are generally within about 200 to 500 meters, while macro connections in built-up areas can extend to 800 meters or more. Near transit hubs several small cells approached -70 dBm, indicating repeaters operating roughly 150 meters from the survey route.

No unregistered cell IDs were observed and transmissions remained within expected bands and power levels. This baseline sets a clear tripwire. Any future cell ID that does not appear in licensed records or any signal significantly stronger than -65 dBm (about 50 meters or closer) should be investigated.

Anomaly Thresholds

An anomaly is any transmission that departs from the established wireless baseline. The following criteria define what merits immediate attention:

• Wi Fi: Open SSID stronger than -70 dBm or any encrypted SSID broadcasting at an unusually strong level around -50 dBm or higher.
• Bluetooth Classic: Broadcast sessions that persist more than 30 minutes without user activity or appear outside normal commute periods, especially when signal strength exceeds -33 dBm.
• Bluetooth Low Energy: Hidden or randomized identifiers exceeding 60 per waypoint on a single pass or any beacon at -33 dBm with no vendor match.
• Cellular: A cell ID not present in licensed records, or any site transmitting stronger than -65 dBm which indicates a device within roughly 50 meters.

These thresholds focus investigative effort on the signals most likely to reflect misconfiguration, insider enabled misuse, or hostile collection systems.

Conclusion

This baseline defines what normal wireless activity looks like in the locale environment and provides practical thresholds for distinguishing routine signals from outliers. It is a static snapshot that anchors future comparisons. Analysts can use it to triage new detections, decide which signals merit closer review, and maintain a shared reference for what counts as typical in each band.

The coverage is comprehensive across Wi Fi, Bluetooth Classic, Bluetooth Low Energy, and cellular. Confidence is highest where detections are dense and repeatable and lower at the edges of the perimeter or in areas with intermittent collection. Values that sit just inside the anomaly thresholds should be treated as context dependent rather than automatically suspicious.

Change over time is the most important signal. A shift in vendor mix, a sustained rise in hidden identifier volumes at a single waypoint, or a new cell identifier that was not present in this edition are examples of meaningful divergence from the baseline. When such divergence appears, compare against the tables and narrative norms in this report to determine whether the new activity is consistent with benign growth in civilian infrastructure or whether it represents a departure that warrants further scrutiny.