Asymmetric Defence Doctrine
How civilian infrastructure becomes a distributed defence mesh.
The strategic framework behind INDIGO AirGuard.
Every design decision must widen the cost gap between attacker and defender. The system succeeds not by matching the adversary's expenditure but by making each attack economically irrational.
The Problem: Interceptor Economics
(RUSI, 2023 — OSINT consensus: $20K–50K)
(per missile, ~$1B per battery)
when defender uses kinetic intercept
Firing a EUR 4M Patriot at a EUR 20K Shahed is an economic disaster. AirGuard inverts this equation: detect for EUR 0 per smartphone sensor, then cue a EUR 1K–2K Gepard burst instead.
Proven Cost Ratios: Cyber Domain (Measured, March 2026)
| Metric | Value | Source |
|---|---|---|
| Defender one-time investment | $50 | LiquidSentinel deployment, Feb 2026 |
| Defender monthly operating cost | $15/month | mail.loftrek.ro operational data |
| Attacker imposed monthly cost | $1,000–5,200/month | 694,835+ malicious requests, 5 campaigns |
| Cost asymmetry ratio | 67:1 to 347:1 | Measured, March 2026 |
| Abuse reports filed | 42 across 6+ countries | SOP-ABUSE-001; CERT-EE tickets |
Applied to Drone Defence
| Threat | Attacker Cost | AirGuard Detection Cost | Ratio |
|---|---|---|---|
| Shahed-136 (one-way attack drone) | $20K–50K per unit | $0 per smartphone sensor | Infinite |
| Lancet-3 (loitering munition) | $35K–60K per unit [UNGROUNDED] | <$200 per GPS-PPS node | >175:1 |
| 10-drone Shahed salvo | $200K–500K | ~$6K full 8-modality prototype | 33:1 to 83:1 |
| Sustained campaign (30/month, 1 year) | $7.2M–18M | $550K + $120K/year [UNGROUNDED] | 11:1 to 27:1 |
Shahed-136 unit cost: OSINT consensus from RUSI and open-source defence analysts. Sustained campaign costs: extrapolated linearly from municipal pilot [UNGROUNDED].
Six foundational principles govern every architectural, operational, and institutional decision in the AirGuard doctrine.
Every design decision must widen the attacker-defender cost gap. The defender's marginal cost curve is flat ($0 per phone); the attacker's is linear ($20K+ per drone). Defence by economic exhaustion, not force parity.
Zero RF emissions means zero ESM/ELINT vulnerability, zero regulatory burden, zero electromagnetic interference. Sensors are invisible to the adversary. No spectrum allocation required.
Leverage smartphones, WiFi, DVB-T towers, and cellular base stations as sensor elements. Destroying the defence requires destroying civilian infrastructure — an escalation the adversary cannot justify.
All inference runs on-device. Raw audio never leaves the smartphone. Only classification labels, confidence scores, and approximate locations are transmitted (encrypted). Privacy is enforced by system design, not policy.
No single point of failure. With 1,000 nodes: lose 50% and system Pd remains >0.99998. Lose 90% and Pd is still 0.83. No single countermeasure defeats all 8 detection layers simultaneously.
A drone detected in Ukraine generates a signature that protects Estonia and Romania. Shared detection data multiplies its value across every mesh participant. Proven model: biweekly CERT-EE intelligence feeds (tickets CERT-132536, CERT-135136, CERT-139652).
Hybrid warfare operates across five domains simultaneously. A defence that monitors only physical airspace leaves four domains undefended. AirGuard's mathematical primitives — CFAR, EKF, CV timing analysis — are domain-universal.
Physical
Drones, missiles, sabotage, border infiltration
AirGuard Core System
Acoustic CFAR, PBR, FSR, ACIR, seismic
Cyber
Network intrusion, DDoS, supply chain compromise
LiquidSentinel (Operational)
807 threats detected, 694K+ requests analysed
Economic
Fraud, sanctions evasion, economic coercion
Exploration
Transaction CFAR, network graph analysis
Information
Disinformation, FIMI, deepfakes, narrative manipulation
Exploration
Coordination detection, honeypot profiles
Societal
Trafficking, illegal gambling, corruption, societal erosion
Exploration
Route CFAR, supply chain tracking
The unifying insight: CFAR detection works against any background distribution. Whether the background is urban acoustic noise, network traffic, financial transactions, or social media activity — the detection algorithm is universal. Only feature extraction is domain-specific.
Cross-domain correlation: A Shahed launch (physical) preceded by DDoS on air defence C2 (cyber) and a narrative campaign (information) is more confidently attributed than any single-domain detection. All domains publish to the same NATS mesh.
Physical domain: validated implementation (TRL 4). Cyber domain: operational (LiquidSentinel, 807 threats). Economic, Information, Societal domains: theoretical framework with shared mathematical primitives — not yet validated at operational confidence levels.
AirGuard is designed from inception for integration with European and NATO institutional frameworks.
PESCO Counter-UAS
Led by Italy (AT, CZ, LV, NL). AirGuard provides the distributed detection layer that complements kinetic and electronic countermeasures. 26 of 27 EU members participate in PESCO.
Defence Cooperation
European Defence Fund
EUR 7.953B for 2021–2027 (Reg. (EU) 2021/697). Counter-UAS and distributed sensing explicitly in EDF work programmes. Cross-border AISBL consortium meets eligibility.
Funding Pathway
NATO DIANA
Defence Innovation Accelerator. Accelerator sites in Estonia and Romania — aligned with AirGuard deployment geography. Challenge areas: sensing, surveillance, dual-use tech.
Innovation Pipeline
MIL-STD-6090 CoT
Native Cursor-on-Target XML output for every confirmed track. Directly consumable by ATAK, WinTAK, TAK Server — standard across NATO forces.
Interoperability
EU AI Act Compliance
Privacy-by-architecture satisfies Regulation (EU) 2024/1689. On-device inference, no raw data transmission, human-in-the-loop for response levels above OBSERVE. GDPR compliant.
Regulatory Alignment
NIS2 Directive
Directive (EU) 2022/2555 requires enhanced cybersecurity for critical infrastructure. AirGuard protects transport, energy, and digital infrastructure sectors from drone threats.
Critical Infrastructure
ReArm Europe / SAFE Programme
European Commission proposal (March 2025, COM(2025) 120) to mobilize defence investment. Counter-UAS explicitly named as a priority capability gap. Air and missile defence, drone and counter-drone among priority areas.
Note: Legislative proposal, not enacted law. Funding pathways are aspirational, not confirmed [UNGROUNDED].
Legal Framework Alignment
| Framework | Relevance to AirGuard | Status |
|---|---|---|
| Budapest Convention (ETS No. 185) | Cross-border evidence sharing; STIX 2.1 output for evidentiary use | Aligned |
| Wassenaar Arrangement | COTS hardware below control thresholds; open-source eligible for General Software Note | Compliant |
| STANAG 4586 / 4559 | UAS control system interface; ISR library metadata format | Design target |
| Tallinn Manual 2.0 | Legal framework for cyber operations (NATO CCDCOE, 2017) | Aligned |
Institutional Engagement Sequence
Credibility is earned sequentially. Each phase builds the trust required for the next.
Active biweekly intelligence feeds to Estonian CERT (NATO CCDCOE partner). 3 deliveries, 3 ticket references (CERT-132536, CERT-135136, CERT-139652). 63 IOCs across 5 campaigns. TLP:AMBER methodology paper + PGP-encrypted CSV feeds.
European Alliance for Responsible Computing. Framework for responsible dual-use technology. Privacy-first architecture and on-device inference align with E-ARC principles.
EUDIS demonstrates TRL 4–5. DIANA challenge targets TRL 5–6. DIANA accelerator targets TRL 6–7. Accelerator sites in Estonia and Romania directly aligned with deployment geography.
Deployment Roadmap: Municipal to Alliance Scale
| Phase | Scale | Sensors | Hardware Cost | TRL |
|---|---|---|---|---|
| Phase 1: Hackathon (Q1 2026) | 50 km² | 10 devices | ~EUR 6,000 | TRL 4 |
| Phase 2: City Pilot (2026) | 228 km² | 1,000+ phones, 50 nodes | ~EUR 17,000 | TRL 5–6 |
| Phase 3: National (2027–28) | ~50,000 km² | 50K phones, 500 nodes | ~EUR 550,000 [UNGROUNDED] | TRL 7–8 |
| Phase 4: Alliance Pilot (2028–29) | 3+ nations | Cross-border mesh | EDF + PESCO funded [UNGROUNDED] | TRL 8–9 |
| Phase 5: NATO-wide (2030) | 10+ nations | Millions of participants | Sustained EDF + national [UNGROUNDED] | TRL 9 |
Phase 1 costs: measured (hackathon hardware BOM). Phases 3–5: extrapolated linearly from municipal pilot — actual costs depend on per-jurisdiction regulatory compliance, coordination overhead, and maintenance logistics [UNGROUNDED].
Europe's asymmetric advantage is not military mass — it is the depth and sophistication of its civilian infrastructure. Every piece of infrastructure the adversary cannot destroy without strategic consequence becomes a defence asset.
Source: GSMA, 2025
Source: DVB Project
100M+ private [UNGROUNDED]
Source: FTTH Council Europe
500K+ planned (GSMA)
Ground vibration detection
How Each Becomes a Defence Asset
| Infrastructure | Defence Function | Cost to Defender |
|---|---|---|
| Smartphones | Acoustic sensors (YAMNet on-device inference) | EUR 0 |
| DVB-T transmitters | Passive bistatic radar illuminators (1–3 km range, 20m resolution) | EUR 0 |
| WiFi access points | ACIR sensing — channel impulse response disturbance detection | EUR 0 |
| Cellular base stations | FSR illuminators at 900 MHz (optimal for Babinet enhancement: +34 dB) | EUR 0 |
| Fibre-optic networks | Distributed Acoustic Sensing potential [UNGROUNDED — not implemented] | EUR 0 |
| Power grid (50 Hz ENTSO-E) | Phase-coherent timing reference for interferometry | EUR 0 |
The strategic logic: An adversary cannot suppress DVB-T illuminators without blacking out television for millions. Cannot jam WiFi without shutting down civilian internet. Cannot destroy cellular base stations without crippling emergency communications. The defence is woven into the fabric of civilian life.
Europe's Five Asymmetric Advantages
| Advantage | Description | Defence Exploitation |
|---|---|---|
| Infrastructure depth | 450M smartphones, 200K+ transmitters, 3M hotspots, 10M km fibre | Distributed sensing at near-zero marginal cost |
| Institutional trust | CERT network, ENISA, Europol, EDA, PESCO, EDF | Coordinated response across 27 member states |
| Economic scale | EUR 15.8T GDP (Eurostat, 2024) | Outspend any adversary on sustained investment |
| Technology ecosystem | CERN, Fraunhofer, INRIA, VTT + SME innovation base | Rapid development and deployment |
| Democratic resilience | Free press, independent judiciary, civil society | Self-correcting framework resistant to capture |
Historical Precedent
The pattern is consistent across centuries: nations that view civilian infrastructure as a defence asset are extraordinarily difficult to defeat.
Distributed radar chain — first networked early warning system
Passive acoustic submarine detection across ocean basins
National cyber resilience from civilian-military integration
Civilian smartphone networks for acoustic early warning