Signals intelligence has evolved into a cyber-centric activity.

Eleven years ago, Edward Snowden, a contractor working for the National Security Agency (NSA), America’s signals-intelligence (SIGINT) service, fled to Hong Kong and then to Russia. He revealed that America and its allies were collecting a large portion of the world’s communications. Intelligence agencies warned of dire consequences, as enemies would find other ways to communicate. However, the impact of Snowden’s disclosure was not as severe as feared. While agencies could no longer access all the data they needed, they were still able to obtain a significant amount of information.

Ciaran Martin, a former senior official at GCHQ, Britain’s SIGINT agency, explained that agencies could still access “lots” of data, which was enough to provide American SIGINT with a majority of intelligence, including intercepts of communications that exposed Russia’s plans to invade Ukraine in 2021. Over the past two decades, SIGINT has undergone significant transformation. The internet replaced radio and telephone traffic in the 1990s, and now, a decade after Snowden’s revelations, most internet traffic is encrypted, and data is stored in new locations like the cloud.

These changes have blurred the lines between cyber-espionage and cyber-attacks, as computer networks that transport data have become intertwined with physical systems like cars, power grids, and military systems. Despite these shifts, SIGINT agencies remain powerful intelligence-gathering entities, capable of extracting valuable information from the digital realm.