Back in 2022, I wrote about the transition from the original eCall system to Next Generation eCall, or NG eCall. At the time, one of the big concerns was what would happen to millions of vehicles relying on 2G and 3G as mobile operators gradually switched off these legacy networks.
Four years later, the transition is no longer something happening in the distant future. 2026 is an important year for NG eCall in Europe.
For anyone unfamiliar with eCall, it is the European emergency calling system built into vehicles. Following a serious accident, the vehicle can automatically call the European emergency number 112, or the call can be triggered manually. Along with establishing a voice connection, the vehicle sends a Minimum Set of Data (MSD) containing information such as its location, direction of travel and other relevant vehicle information. eCall has been required for new M1 and N1 vehicle types in the EU since April 2018.
The problem is that the original eCall architecture was designed around circuit-switched 2G and 3G networks. The MSD is transferred using an in-band modem during the emergency voice call.
NG eCall takes a different approach. It uses packet-switched connectivity and IMS, allowing eCall to operate over 4G LTE and 5G. At the protocol level, it becomes an IMS emergency call, with SIP used for call signalling and the eCall MSD carried as emergency-call data within the SIP-based session.
This transition became much more significant on 1 January 2026. From that date, new M1 and N1 vehicle types in the EU have to support packet-switched eCall. Public Safety Answering Points (PSAPs) that were already deployed are also required to support eCall over packet-switched 4G/5G networks from the beginning of 2026.
The standards have continued to evolve as well. Commission Delegated Regulation (EU) 2025/1871 updated the regulatory references to the newer EN 17184:2024, covering eCall high-level application protocols using IMS over packet-switched networks, and EN 17240:2024, covering end-to-end conformance testing. There are transitional arrangements during 2026, with the newer EN standards becoming mandatory for new type approvals from 1 January 2027.
There is also evidence that the ecosystem is moving from specifications to actual interoperability testing. In June 2026, ETSI organised its latest NG eCall Plugtests in Ljubljana. Testing focused on interoperability between In-Vehicle Systems (IVS) and PSAPs over 4G LTE, and importantly included access to a real Telekom Slovenije mobile network rather than relying entirely on simulated infrastructure. Testing used ETSI TS 103 683, with EN 17240:2024 conformance testing also supported.
However, moving new vehicles to NG eCall does not make the legacy problem disappear.
The existing European vehicle fleet contains a very large number of cars whose eCall systems still depend on 2G/3G. EU rules therefore require PSAPs to continue supporting circuit-switched eCall while at least one circuit-switched mobile network remains operational in the relevant Member State.
A European Commission Joint Research Centre study published in May 2026 highlights the scale of the challenge. Its modelling estimates that there could still be around 66.8 million passenger vehicles equipped with circuit-switched eCall at the end of 2027. The study considers several possible mitigation approaches, including upgrading suitable existing eCall units to 4G, using 4G-capable third-party eCall systems and providing aftermarket solutions for vehicles that cannot otherwise be upgraded.
So, in some ways, we now have two parallel eCall transitions taking place. New vehicles and emergency infrastructure are moving towards IMS-based NG eCall over 4G and 5G, while the industry still has to work out how to keep tens of millions of older vehicles able to contact emergency services as 2G and 3G networks disappear.
The short Rohde & Schwarz video below provides a good overview of how eCall and NG eCall work, followed by an explanation of how the technology can be tested from the GNSS module and telematics control unit (TCU) through to complete vehicle-level testing.
Anyone who travels regularly by train will recognise the experience. The phone shows a mobile signal, sometimes even 5G, but webpages refuse to load, video calls freeze and messages remain stuck sending. Switching to the train’s Wi-Fi may not help either. The device connects to the access point, but there is little or no usable internet behind it.
Providing reliable connectivity on a moving train is much harder than providing coverage to a home, office or even a vehicle on a road. A railway combines weak and inconsistent outdoor coverage, a radio-unfriendly metal carriage, high-speed mobility, frequent handovers, difficult terrain and hundreds of passengers competing for limited capacity.
Recent measurement studies confirm how serious the problem remains.
An Ofcom-commissioned study measured mobile and on-board Wi-Fi performance across 50 journeys on 24 railway lines in Great Britain during February and March 2026. Its “Good Performance” threshold required at least 5 Mbit/s download, 1.5 Mbit/s upload and latency of no more than 50 milliseconds in the same test cycle.
The best-performing mobile network met that threshold only 42% of the time. The other three networks achieved between 17% and 21%. On-board Wi-Fi met the threshold just 1% of the time. Ofcom also found that latency was often the factor that caused a test to fail, even when download and upload speeds appeared adequate.
While this is a UK study, the problem is by no means unique to the UK. Ookla’s Q2 2025 comparison of train Wi-Fi across Europe and Asia found enormous differences between countries. Sweden achieved a median download speed of 64.58 Mbit/s, followed by Switzerland at 29.79 Mbit/s. At the other end of the scale, the UK achieved 1.09 Mbit/s and the Netherlands just 0.41 Mbit/s. The gap between the strongest and weakest markets was as much as 158 times.
The variation is important because it demonstrates that poor connectivity is not an unavoidable consequence of travelling by train. The engineering challenges are common, but the results depend heavily on how rail connectivity is planned, funded and operated.
Mobile networks are normally designed around where people live, work and spend most of their time. Sites are positioned and optimised to serve towns, cities, business areas and roads. Railway lines frequently pass through rural areas, cuttings, forests, valleys and other places where there may be little commercial demand beyond the passengers moving through.
A train may therefore spend much of its journey travelling along the edge of several mobile cells rather than through a strong, continuous coverage layer designed for the railway. A conventional mobile coverage map may show service in the surrounding area without accurately representing the signal available inside a carriage moving along the track.
Even where the outdoor signal is usable, it still needs to enter the train.
Modern rolling stock contains metal bodywork, foil-backed insulation and energy-efficient glazing. Low-emissivity windows often contain thin metallic coatings that reduce heat transfer but also reflect or absorb radio signals. The signal available outside the train can consequently be far stronger than the one reaching a passenger’s phone.
The uplink can be even more difficult. A mobile base station has relatively high transmit power, large antennas and sophisticated radio processing. A smartphone has limited power and a very small internal antenna. The phone must transmit back through the same coated windows and carriage structure that weakened the incoming signal.
This can explain why a passenger appears to have a reasonable signal or acceptable download speed but still struggles with video calls, file uploads, cloud applications and voice over IP.
Speed adds another layer of complexity. A phone or on-board communications gateway must continually measure nearby cells and hand the connection from one to another. At high speed, the device remains within each cell for less time and radio conditions can change significantly between a measurement and the handover itself.
Short interruptions may be almost invisible to a background download, but they can freeze a video call, interrupt a conversation or cause an application session to time out. Tunnels, deep cuttings, hills, buildings and vegetation can create additional sudden changes in signal quality.
Capacity is also shared. A single train can bring hundreds of connected devices into a mobile cell at almost the same moment. That cell may also serve a station, surrounding homes, businesses, road users and another train travelling in the opposite direction. During busy periods, this concentrated demand can increase latency, reduce throughput and create packet loss.
On-board Wi-Fi does not bypass all these challenges.
The passenger’s device connects to an access point inside the train, but the traffic must then pass through an on-board gateway and roof-mounted antennas before reaching an external network. Most train Wi-Fi therefore depends on the same public mobile coverage that passengers may already be struggling to use directly.
A strong Wi-Fi icon only confirms that the passenger has a good connection to the access point. It says nothing about the quality or capacity of the train-to-ground backhaul.
Legacy on-board equipment can make the problem worse. Ookla found that nearly two in five train Wi-Fi connections across the European markets studied still used Wi-Fi 4, while around 22% used the lower-capacity and more interference-prone 2.4 GHz band. Newer Wi-Fi generations and 5 GHz can improve performance within the carriage, but Ookla concluded that the external backhaul is generally the dominant bottleneck.
Simply adding 5G is not a complete answer either. 5G can provide more spectrum, greater capacity, improved latency and better radio efficiency. Ofcom found that 5G Standalone produced a substantial improvement where it was available, but its availability along the measured routes was inconsistent.
The railway still needs continuous outdoor coverage. The signal still needs to enter the train, capacity is still shared, handovers still need to work and the on-board equipment and backhaul must support the service. A 5G icon does not guarantee that every link in this chain is performing well.
There are several possible solutions, but none solves the whole problem independently.
The conventional mobile network can be improved by adding sites near railway coverage gaps, aiming antenna sectors along the track, using lower-frequency spectrum for reach and penetration, and adding capacity around busy stations and corridors.
Where conventional macro coverage is insufficient, dedicated trackside networks can provide closely spaced sites, directional antennas, engineered tunnel coverage and high-capacity fibre or microwave backhaul. This changes the planning objective from serving nearby towns and roads to serving the railway itself.
Trains can use high-performance roof-mounted antennas connected to intelligent on-board gateways. These systems can combine connections from multiple mobile operators and dynamically switch or bond links as conditions change. Genuine diversity is greatest where the operators use independent infrastructure rather than sharing the same underlying radio network.
Laser-treated, RF-permeable windows provide another approach. Fine patterns are removed from the metallic window coating, allowing more of the outdoor mobile signal to enter while retaining much of the window’s thermal performance. Tests cited by Ookla reported losses of approximately 20 to 30 dB from conventional coated windows, and Deutsche Bahn has announced a large-scale programme to treat tens of thousands of windows.
This is a passive solution that can benefit passengers using different networks and frequency bands. However, it only improves signal entry. It cannot create outdoor coverage or additional network capacity.
Active systems such as repeaters, distributed antenna systems and on-board small cells can bring mobile service directly into the carriage. These systems must be carefully engineered and coordinated with the mobile operators.
There is also an interesting interaction between repeaters and RF-permeable windows. A repeater requires sufficient isolation between its external donor antenna and the service antennas inside the train. If more of the amplified indoor signal escapes through treated windows and reaches the donor antenna, it can reduce isolation and create feedback, gain reduction or oscillation. Repeaters and treated windows can coexist, but they need to be designed and tested as one RF system.
For passenger Wi-Fi, the likely long-term architecture is a hybrid one. Modern Wi-Fi 6 or Wi-Fi 7 access points inside the carriage can connect to an intelligent gateway combining multiple cellular operators, dedicated trackside networks, station connectivity and low Earth orbit satellite backhaul.
LEO satellite systems such as Starlink and OneWeb are increasingly being considered as complementary links, particularly on rural and lightly served routes. They are not replacements for terrestrial connectivity because tunnels, deep cuttings, buildings and vegetation can obstruct the view of the sky. Rail-certified terminals must also meet demanding requirements for vibration, weather protection, power and electromagnetic compatibility. The most resilient approach is therefore to combine satellite and terrestrial links rather than depend entirely on either one.
Ultimately, there is no single fix for poor connectivity on trains. Reliable service requires the complete chain to work together: Railway-specific outdoor coverage + signal entry into the carriage + on-board distribution + sufficient backhaul + reliable mobility + capacity management + commercial coordination
Improving only one layer can leave another layer as the bottleneck. The train operator, rail infrastructure owner, mobile operators, rolling-stock manufacturer, connectivity provider, regulator and government all control different parts of the solution.
The video below explores these challenges and possible solutions in more detail.
Finally, for anyone working on passenger connectivity, train-to-ground communications or trackside infrastructure, TrainComms 2026 takes place in London on 18 and 19 November. The conference brings together train operators, rail infrastructure organisations, mobile and satellite connectivity providers, equipment vendors and other specialists to discuss on-board Wi-Fi, trackside wireless networks and emerging LEO satellite solutions. I will be attending again this year, so please do say hello if you are there.
3GPP Release 19 continues the evolution of 5G-Advanced and, among many other areas, brings important enhancements for satellite access, Non-Terrestrial Networks (NTN), Uncrewed Aerial Systems (UAS), Air-to-Ground networks and positioning. While NTN was initially seen by many as a way of extending mobile coverage to remote areas, Release 19 shows that the ambition is now much broader. The aim is to make satellite and aerial connectivity more practical, more resilient and better integrated with the 5G ecosystem.
Release 17 introduced the first major NR NTN framework, largely focused on transparent satellite payloads. Release 18 added further improvements, including mobility and service continuity enhancements. Release 19 now moves the discussion towards more advanced capabilities, including regenerative payloads, Store-and-Forward satellite operation, UE-Satellite-UE communication, improved support for IoT NTN and better support for aircraft and drones.
One of the key areas in Release 19 is NR NTN Phase 3. Satellite links face challenges that are very different from terrestrial mobile networks. The distances are much greater, propagation delays are longer, satellite beams can cover very large geographical areas and satellite payload power is limited. Release 19 addresses these constraints through improved coverage and capacity mechanisms. For example, important control and system information can be repeated to improve the chance that devices can successfully receive and decode it. This is especially important for handset-type terminals and power-limited devices operating in challenging satellite conditions.
This also connects to the wider industry discussion around Direct-to-Device satellite connectivity. 3GPP does not always use the marketing phrase Direct-to-Device, but the work on improved downlink performance for handset-type terminals is clearly relevant to that vision. It is worth being careful with the abbreviation D2D, as in standards discussions it can also mean Device-to-Device. For this reason, Direct-to-Device is probably the clearer term when talking about phones or lightweight devices connecting directly to satellites.
Release 19 also improves uplink capacity in NTN through multiplexing techniques such as Orthogonal Cover Codes. This matters because a satellite beam can cover a large area with many potential users, while the available spectrum and power remain limited. Better multiplexing means more users and devices can be supported with the same satellite resources. This will become increasingly important as NTN expands beyond emergency messaging towards IoT, broadband and more diverse services.
Perhaps the most interesting architectural shift is the support for regenerative payloads and gNB functions on board the satellite. In a traditional transparent payload model, the satellite mainly acts as a relay, with most processing taking place on the ground. With regenerative payloads, more intelligence moves into space. The satellite can process, switch or route signals, making the network more flexible and less dependent on a continuous feeder link to the ground.
This helps enable one of the most distinctive Release 19 capabilities, Store-and-Forward satellite operation. In some non-geostationary satellite scenarios, the satellite may be visible to the UE but may not have a simultaneous active feeder link to the ground network. Store-and-Forward allows the satellite to temporarily store data and forward it later when connectivity to the ground segment becomes available. This is especially useful for delay-tolerant IoT applications such as asset tracking, environmental sensing, remote monitoring and logistics.
Another new area is UE-Satellite-UE communication. Normally, traffic between two users would travel via the satellite, the ground network and then back again. Release 19 starts enabling a more direct path via a regenerative satellite architecture. The initial scope is limited, including IMS voice and video services for users in the same PLMN and in non-roaming scenarios, but it is still an important step. It shows how NTN can evolve from simple coverage extension towards a more capable communication platform.
IoT NTN also receives significant attention in Release 19. Enhancements include Store-and-Forward operation for IoT, improved uplink capacity and support for Public Warning System messages over NB-IoT NTN. Release 19 also introduces IoT NTN TDD mode, which is important because earlier NB-IoT NTN work was focused on FDD operation. TDD support gives satellite operators more flexibility and opens the door to additional deployment scenarios.
Public warning support is another practical and important enhancement. Satellite connectivity can be extremely valuable in areas where terrestrial networks are unavailable, damaged or overloaded. Supporting warning messages over satellite and IoT NTN can help extend emergency alerting capabilities to remote regions, maritime environments and disaster-affected areas.
Release 19 is not only about satellites. It also includes enhancements for Air-to-Ground networks and UAS Phase 3. Air-to-Ground connectivity uses ground-based cellular infrastructure to serve aircraft, rather than relying on satellites. Release 19 work in this area supports improvements such as downlink carrier aggregation and MIMO for better throughput and more efficient spectrum use.
For UAS, Release 19 continues the work needed to make drones better integrated into mobile networks and service platforms. This includes support for pre-mission planning, in-mission monitoring, command and control reliability, network-assisted Detect and Avoid, No-Transmit Zones and interaction with UAS traffic management systems. These capabilities matter because drones are increasingly being used for inspection, logistics, public safety, disaster response, smart cities and future urban air mobility.
Positioning is another important part of the Release 19 satellite and aerial story. Enhancements include on-demand broadcast of GNSS assistance data, support for BeiDou B2b in A-GNSS for LTE and NR, and support for NavIC L1 SPS in NR and LTE. These improvements help make positioning more flexible and globally relevant, especially for NTN, IoT, maritime, aviation and UAS use cases.
Taken together, Release 19 shows how NTN is maturing. The focus is no longer just on whether a device can connect to a satellite. The bigger question is how satellite, aerial and terrestrial networks can work together as part of a wider 5G-Advanced system. With regenerative payloads, Store-and-Forward operation, UE-Satellite-UE communication, IoT NTN enhancements, public warning support, Air-to-Ground improvements and UAS integration, Release 19 takes another important step towards making non-terrestrial connectivity practical, resilient and service-rich.
The video below provides a visual walkthrough of these Release 19 satellite, NTN, UAS and aerial enhancements.
The Citizens Broadband Radio Service, better known as CBRS, has often been described as an experiment in spectrum sharing. Based on the latest OnGo Alliance webinar on the state of CBRS, that description no longer feels accurate. CBRS is now a sizeable and maturing wireless ecosystem in the United States, supporting mobile operators, cable companies, wireless internet service providers, private network deployments, neutral host systems and a growing range of enterprise use cases.
For those less familiar with CBRS, it operates in the 3.5 GHz band in the United States and uses a shared spectrum framework. Rather than relying only on traditional exclusive licensing or completely unlicensed access, CBRS introduced a three-tier model, coordinated through a Spectrum Access System, or SAS. This software-based coordination layer allows different users to access spectrum while protecting incumbent users, including government and defence systems.
The model has taken more than a decade to develop. The discussion began around 2012, when US policymakers and defence stakeholders started exploring whether mid-band spectrum could be shared more efficiently between government and commercial users. The first FCC rule and order arrived in 2015, followed by the creation of the OnGo Alliance in 2016. The role of the Alliance was to bring together government, industry, technology providers and users to translate the regulatory framework into a workable commercial ecosystem.
A key point from the webinar was that CBRS has not developed as a single-sector technology. It is not just for mobile operators, and it is not just for private wireless. It brings together mobile network operators, cable companies, WISPs, system integrators, RAN vendors, device manufacturers, SAS administrators, enterprises, airports, campuses, healthcare facilities, utilities and many others. This diversity is one of the main reasons CBRS has become interesting from a broader telecoms perspective.
The scale of deployment is now significant. The webinar highlighted more than 437,000 CBRS devices deployed across the United States, more than 1,000 CBRS operators and networks, around 1,100 certified end-user devices supporting Band 48, and more than 1,800 private network deployments. The total ecosystem investment was described as being more than 14 billion US dollars, including spectrum, equipment, standardisation, technology development, SAS infrastructure and sensing networks.
The Priority Access Licence, or PAL, auction also played an important role. Auction 105 raised close to 5 billion US dollars and created around 22,000 PAL licences. Unlike some traditional spectrum auctions, the county-based licence areas allowed smaller and regional players to participate, particularly in rural and suburban markets. This is important because CBRS has become a practical tool not only for national-scale operators but also for smaller service providers addressing local connectivity needs.
One of the most useful ways to understand CBRS is to place it between two familiar models. On one side there is unlicensed spectrum, mainly associated with Wi-Fi, which is easy to access but can suffer from congestion and unpredictability. On the other side there is exclusive licensed spectrum, which provides stronger control but is expensive, complex and usually held by major operators. CBRS sits between these models. General Authorised Access, or GAA, provides licence-by-rule access, while PAL provides a higher-priority licensed layer. The SAS coordinates access and helps manage coexistence.
This software-managed spectrum access model is one of the most important aspects of CBRS. In a traditional licensing model, gaining access to spectrum can be slow and expensive. In CBRS, the SAS can authorise spectrum use in minutes. The network operator interacts with the SAS, while the end user does not need to know that this process is happening. In many deployments, even the radio does not need to communicate directly with the SAS because a domain proxy or network management system can handle that interaction.
The webinar also made clear that CBRS is evolving. CBRS 2.0, introduced in 2024, expanded availability by refining the way incumbent protection is handled. This opened the band to an additional 72 million Americans, mainly through software and regulatory improvements rather than any major change in physical infrastructure. That is a powerful example of how shared spectrum systems can improve over time as data, models and operational experience mature.
Fixed Wireless Access is one of the most visible CBRS use cases. WISPs and FWA providers are using CBRS to serve suburban, rural and ultra-rural communities, often in places where connectivity options are limited. The webinar suggested that CBRS-based WISPs and FWA providers are serving more than 10 million residential customers in the United States, with many of these customers located in areas that have fewer than two viable internet options.
This is a useful reminder that wireless and fibre should not always be seen as competing technologies. In many rural deployments, CBRS is used as part of a hybrid model, with fibre providing backhaul and fixed wireless covering the final stretch. This can be faster and cheaper than extending fibre everywhere, particularly in difficult terrain or sparsely populated areas. It can also be more resilient in emergencies, as wireless networks can often be restored more quickly after fires, floods or other disasters.
The discussion also touched on competition from low Earth orbit satellite systems such as Starlink and future Amazon Kuiper services. The speakers framed satellite and CBRS-based FWA more as complementary technologies than direct competitors. This is a sensible view. Rural broadband is not a single-problem market. Some locations will be better served by terrestrial fixed wireless, some by fibre, some by satellite, and many by a combination of these approaches. The real value comes from having multiple options.
Private networks are another major part of the CBRS story. Enterprises can use CBRS spectrum for their own dedicated cellular networks, with applications tailored to their operational needs. These networks can sit inside the enterprise firewall and support predictable performance, mobility and security. Typical applications include point-of-sale terminals, push-to-talk communications, video surveillance, automated guided vehicles, warehouse systems, robotics, utilities, airports, ports, rail yards and industrial facilities.
The mobility angle is especially important. Wi-Fi is excellent for many indoor and enterprise use cases, but private cellular can provide more predictable mobility, coverage and quality of service in large sites, outdoor environments and industrial locations. As physical AI, robotics and autonomous systems become more widely deployed, reliable wireless connectivity will become more important. CBRS gives enterprises in the United States a practical route to deploy private cellular without needing to own exclusive nationwide spectrum.
Neutral host networks were also highlighted as a major growth area. In this model, an enterprise, venue or building owner deploys CBRS-based infrastructure to improve indoor mobile coverage for users of public mobile networks. This can help solve the common problem of poor indoor mobile signal, dropped calls and dead zones, especially in buildings where a traditional distributed antenna system is too expensive or too difficult to justify.
The safety aspect of neutral host coverage deserves more attention. Buildings often have public safety communications requirements for first responders, but the ability of occupants to call emergency services from inside the building is just as important. A neutral host system integrated with mobile operators can support emergency calling and wireless emergency alerts. This makes indoor cellular coverage not just a convenience issue but a safety and resilience issue.
The webinar suggested that around 80% of buildings in the United States lack adequate mobile coverage. While this figure may vary depending on building type and methodology, the underlying point is easy to recognise. Many offices, schools, hospitals, hotels, warehouses and public buildings still have patchy indoor mobile coverage. CBRS-based neutral host systems could lower the barrier for improving this, especially in mid-sized buildings that would not previously have justified a traditional operator-led solution.
Several verticals were identified as having strong growth potential. Airports are already emerging as a good example, with CBRS supporting operational communications, asset tracking, baggage handling and other behind-the-scenes functions. Ports, shipyards, utilities, factories, schools, campuses, hospitals, tribal communities, hospitality venues, stadiums and public sector facilities were also mentioned as areas where CBRS can support either private networks, neutral host networks or both.
Smart agriculture is another interesting opportunity. Farms often have poor mobile coverage but growing connectivity needs, from precision agriculture and sensors to equipment monitoring and automation. CBRS could provide localised, high-quality coverage where traditional mobile networks are weak or unavailable. Healthcare was also mentioned as a sector with significant potential, particularly as hospitals still rely on a mix of legacy communications tools while demanding more reliable mobile and telemetry connectivity.
One of the more forward-looking points came near the end of the webinar, where CBRS was positioned as a good candidate for AI-enhanced spectrum management. Because CBRS relies heavily on software, propagation models, measurements, databases and SAS-based decision-making, it creates an environment where AI could potentially improve spectrum availability and interference management. This will require careful regulatory support, but the idea is important. Spectrum sharing should not be static. It should improve as better data and better models become available.
The broader lesson from CBRS is that shared spectrum can work when the technical, regulatory and commercial models are aligned. It has created a middle ground between unlicensed and exclusive licensed spectrum. It has enabled smaller operators and enterprises to access mid-band spectrum. It has supported rural broadband, private networks and neutral host systems. It has also shown that incumbent protection and commercial deployment do not have to be mutually exclusive.
There are still challenges. Regulatory uncertainty remains a concern, especially if potential investors or deployers worry that the rules could change. Further refinements will be needed around incumbent protection, antenna heights, fixed satellite protection, indoor systems, distributed antenna systems and future enhancements. However, the direction of travel is positive. CBRS is no longer just a policy experiment or a niche wireless band. It is becoming an important part of the US connectivity landscape.
For markets outside the United States, CBRS is worth watching because it offers a real-world example of dynamic spectrum sharing at scale. Not every country will copy the CBRS model directly, and spectrum availability, incumbent use and regulatory priorities will differ. Even so, the principles are relevant. As demand for mid-band spectrum grows, governments and regulators will need more flexible ways to balance public, private, commercial and national security needs. CBRS shows one way this can be done.
Cybersecurity conversations in telecoms often focus on IT systems, cloud platforms and enterprise networks. Yet beyond the data centres and mobile cores lies another domain that is arguably even more critical to society. Industrial Control Systems (ICS) and Operational Technology (OT) environments underpin the power plants, water treatment facilities, railways, petrochemical sites and manufacturing plants that keep daily life running. These environments are increasingly in the crosshairs of cyber attackers.
A comprehensive YouTube course titled OSINT for ICS and OT brings much needed attention to this area. Created by Mike Holcomb, the 10 plus hour course explores how Open Source Intelligence (OSINT) can be used to better understand, assess and protect ICS and OT environments. For anyone working in telecoms infrastructure, utilities, transport or industrial sectors, this is highly relevant material.
Mike focuses on the practical reality that there are still relatively few accessible and high quality resources dedicated to OT and ICS cybersecurity. While IT security has matured with abundant training paths, certifications and community support, the world of control systems security remains comparatively underserved. That gap is particularly concerning given the importance of critical infrastructure to national resilience and economic stability.
Nice picture explaining the convergence of IT & OT - "While IT focuses on data and business processes, OT is dedicated to the control and monitoring of physical operations... Convergence of IT/OT generally means that the OT network is now accessible from the outside world via..." pic.twitter.com/i9RrWrr1hb
In his channel overview, Mike explains that his work is aimed at a broad audience. It includes IT cybersecurity professionals looking to pivot into OT security, engineers already working in industrial environments who want to strengthen their defensive posture, and owners or operators who are building or refining a cybersecurity programme for their facilities. This inclusive approach reflects the multidisciplinary nature of OT security, where engineering, networking and cybersecurity disciplines intersect.
The turning point for many in this field was the discovery of Stuxnet, the first widely known cyber weapon designed to disrupt industrial processes. The malware specifically targeted centrifuges in a uranium enrichment facility, manipulating physical processes while masking its actions from operators. For Mike, learning about Stuxnet sparked a deeper curiosity about how control systems function inside power plants and other facilities, and how they can be secured. That same question remains highly relevant today.
For readers of The 3G4G Blog, there is a natural connection. As telecom networks evolve towards 5G, private networks and future 6G systems, connectivity is extending deeper into industrial domains. Smart grids, connected factories and digitalised transport systems rely on robust communications as well as secure control environments. The boundary between IT and OT continues to blur. Understanding how adversaries might gather intelligence about exposed assets, misconfigurations or vulnerable systems using open sources is therefore a critical skill.
The OSINT for ICS and OT course aims to demystify that process. It looks at how publicly available information can reveal insights about industrial environments and how defenders can use the same techniques proactively. Rather than waiting for an incident, organisations can identify potential weaknesses and exposure before an attacker does. This proactive mindset aligns closely with modern security best practice across both telecom and industrial sectors.
Another important aspect is accessibility. The course is freely available on YouTube, lowering the barrier to entry for those who may be curious about OT security but unsure where to start. In a domain where specialist training can be expensive and difficult to find, open educational content plays a valuable role in building community knowledge and capability.
Critical infrastructure protection is not a niche concern. It affects the electricity that powers base stations, the water that cools data centres and the transport systems that support supply chains. As cyber threats continue to evolve, the need for professionals who understand both networking and industrial control environments will only grow.
For those interested in expanding their horizons beyond traditional telecom security and into the protection of the systems that underpin modern society, this course is well worth exploring. It is encouraging to see experienced practitioners sharing knowledge openly and helping to strengthen resilience across critical infrastructure sectors.
AI has become so deeply embedded in our everyday working lives that it is no longer limited to data science teams or research labs. In telecoms, AI now plays a central role in network planning, optimisation, assurance and automation. As a result, the industry is rapidly absorbing a growing set of AI-related terms and concepts, many of which are directly relevant to how networks are evolving towards higher levels of autonomy.
I recently came across the video embedded below, which provides clear explanations of seven AI terms that are becoming increasingly important in the context of network intelligence and autonomous networks. Some of these concepts are already being applied in operational networks today, while others point clearly towards the direction of travel for AI-native 5G Advanced and 6G systems.
The video begins with Agentic AI, a concept that aligns closely with the telecom industry’s vision for autonomous networks as defined in 3GPP. Unlike traditional AI models that respond to a single prompt, AI agents can perceive their environment, reason about next steps, take action and observe the outcome in a continuous loop. In practical terms, this maps well to closed-loop automation use cases such as self-healing, energy optimisation, dynamic resource allocation and intent-driven network management.
Closely related are Large Reasoning Models, which are designed to work through problems step by step rather than producing an immediate response. This capability is particularly relevant for telecom networks, where decisions often span multiple domains, layers and vendors. As AI systems take on greater responsibility for operational decisions, reasoning-based models become essential for safe and explainable automation.
The video then moves to more foundational enablers, starting with Vector Databases. Telecom networks generate vast volumes of unstructured data, including logs, alarms, performance metrics, configuration data and documentation. Vector databases allow this information to be searched and correlated based on semantic meaning rather than simple keywords, enabling more context-aware and intelligent AI systems.
This naturally leads to Retrieval-Augmented Generation (RAG), which is already gaining traction in telecom operations. By combining large language models with operator-specific data sources such as standards, network documentation or operational procedures, RAG helps ground AI outputs in trusted information. This is particularly important in network operations, where accuracy and reliability are critical.
Another important concept discussed is the Model Context Protocol (MCP), which addresses how AI models interact with external tools and systems. For telecom operators, standardised mechanisms for AI access to network management systems, data platforms and orchestration tools could significantly simplify integration and accelerate the deployment of AI-driven automation across the network lifecycle.
The video also touches on Mixture of Experts (MoE) models, which provide a more efficient way to scale AI by activating only the parts of a model needed for a specific task. This approach is especially relevant for telecom use cases where compute efficiency, latency and energy consumption are key constraints, particularly as AI capabilities move closer to the edge of the network.
Finally, the video briefly discusses Artificial Superintelligence (ASI). While ASI remains theoretical, it is often referenced in long-term discussions around AI evolution. For the telecom industry, it serves as a reminder of the rapid pace of change and the importance of governance, trust and control as networks become increasingly autonomous and software-driven.
Overall, this video offers a useful technical refresher on AI concepts that are already shaping the development of network intelligence, autonomous operations and AI-native architectures. For anyone working on 5G Advanced, autonomous networks or early 6G thinking, these are terms that are quickly becoming part of the industry’s everyday vocabulary.
Telecom security rarely stands still. Each year brings new technologies, new attack paths, and new operational realities. Yet 2025 was not defined by dramatic new exploits or spectacular network failures. Instead, it became a year that highlighted how persistent, patient and methodical modern telecom attackers have become.
The recent SecurityGen Year-End Telecom Security Webinar offered a detailed look back at what the industry experienced during 2025. The session pulled together research findings, real world incidents and practical lessons from across multiple domains, including legacy signalling, eSIM ecosystems, VoLTE vulnerabilities and the emerging world of satellite-based mobile connectivity.
For anyone working in mobile networks, the message was clear. The threats are evolving, but many of the core problems remain stubbornly familiar.
A Year of Stealth Rather Than Spectacle
One of the most important themes from the webinar was that 2025 did not bring a wave of highly visible disruptive telecom attacks. Instead, it was characterised by quiet, low profile intrusions that often went undetected for long periods.
Operators around the world reported that attackers increasingly favoured living-off-the-land techniques. Rather than deploying noisy malware, intruders looked for ways to gain legitimate access to core systems and remain hidden. Lawful interception platforms, subscriber databases such as HLR and HSS, and internal management platforms were all targeted.
The primary objective in many cases was intelligence collection. Attackers were interested in call data, subscriber information and network topology rather than immediate disruption. This shift in motivation makes detection far more difficult, as there are often few obvious signs of compromise.
At the same time, automation has become a defining feature on both sides of the security battle. Operators are investing heavily in AI and machine learning to identify abnormal behaviour. Attackers are doing exactly the same, using automation to scale phishing campaigns and to accelerate exploit development.
Despite all this technology, basic security discipline continues to be a major challenge. A significant proportion of incidents still originate from human error, poor operational practices or simple failure to apply patches. The industry continues to invest billions in cybersecurity, but much of that effort is consumed by reporting and compliance activities rather than direct threat mitigation.
eSIM Security Comes into Sharp Focus
The transition from physical SIM cards to eSIM and remote provisioning is one of the most significant structural changes in the mobile industry. It offers clear benefits in terms of flexibility and user experience. However, the webinar highlighted that it also introduces entirely new security concerns.
Traditional SIM security models relied heavily on physical control. Fraudsters needed access to large numbers of real SIM cards to operate at scale. With eSIM, many of those physical constraints disappear. Remote provisioning expands the number of parties involved in the connectivity chain, including resellers and intermediaries who may not always operate under strict regulatory oversight.
During 2025 several major SIM farm operations were dismantled by law enforcement. These infrastructures contained tens of thousands of active SIM cards and were used for large scale fraud, smishing campaigns and automated account creation. While such operations existed long before eSIM, the technology has the potential to make them even easier to deploy and manage.
Research discussed in the session pointed to additional concerns. Analysis of travel eSIM services revealed issues such as cross-border routing of management traffic, excessive levels of control granted to resellers, and lifecycle management weaknesses that could potentially be abused by attackers. In some cases, resellers were found to have capabilities similar to full mobile operators, but without equivalent governance or transparency.
The conclusion was not that eSIM is inherently insecure. The technology itself uses strong encryption and robust mechanisms. The problem lies in the wider ecosystem of trust boundaries, partners and processes that surround it. Securing eSIM therefore requires cooperation between operators, vendors, regulators and service providers.
SS7 Remains a Persistent Weak Point
Few topics in telecom security generate as much ongoing concern as SS7. Despite being a technology from a previous era, it remains deeply embedded in global mobile infrastructure. The webinar dedicated significant attention to why SS7 continues to be exploited in 2025 and why it is likely to remain a problem for many years to come.
Throughout the year, media reports and research papers continued to demonstrate practical abuses of SS7 signalling. Attackers probed networks, attempted to bypass signalling firewalls and looked for new ways to manipulate protocol behaviour. Techniques such as parameter manipulation and protocol parsing tricks were highlighted as methods that can sometimes evade existing protections.
One particularly interesting demonstration showed how SS7 messages could be used as a covert channel for data exfiltration. By embedding information inside otherwise legitimate signalling transactions, attackers can potentially move data across networks without triggering traditional security alarms.
Perhaps the most striking point raised was how little progress has been made in eliminating SS7 dependencies. Analysis of global network deployments showed that only a handful of countries operate mobile networks entirely without SS7. Everywhere else, the protocol remains a foundational element of roaming and interconnect.
As a result, even operators that have invested heavily in 4G and 5G security can still be undermined by weaknesses in this legacy layer. The uncomfortable reality is that SS7 vulnerabilities will continue to be exploited well into 2026 and beyond.
VoLTE and Modern Core Network Risks
While legacy protocols remain a problem, modern technologies are not immune. VoLTE infrastructure in particular was identified as an increasingly attractive target.
VoLTE relies on complex interactions between signalling systems, IP multimedia subsystems and subscriber databases. Weaknesses in configuration or interconnection can open the door to call interception, fraud or denial of service. Several real world incidents during 2025 demonstrated that attackers are actively exploring these paths.
The move toward fully virtualised and cloud-native mobile cores also introduces new operational challenges. Telecom networks now resemble large IT environments, complete with the same risks around misconfiguration, insecure APIs and exposed management interfaces.
The Emerging Security Challenge of 5G Satellites
One of the most forward-looking parts of the webinar focused on non-terrestrial networks and direct-to-device satellite connectivity. What was once a concept for the distant future is rapidly becoming a commercial reality.
Satellite integration promises to extend 5G coverage to remote areas, oceans and disaster zones. However, it also changes the security model in fundamental ways. Satellites can act either as simple relay systems or as active components of the mobile radio access network. In both cases, new threat vectors emerge.
Potential issues discussed included the risk of denial of service against shared satellite resources, difficulties in applying traditional radio security controls in space-based equipment, and the possibility of more precise user tracking due to the way satellite systems handle location information.
Experts from the space cybersecurity community explained how vulnerabilities in mission control software and ground segment infrastructure could be exploited. Much of this software was originally designed for isolated environments and is only now being connected to wider networks and the internet.
As telecom networks expand beyond the boundaries of the Earth, security responsibilities extend with them. Operators will need to think not only about terrestrial threats but also about risks originating from space-based components.
The Human Factor and the Skills Gap
Technology was only part of the story. Another recurring theme was the global shortage of skilled telecom cybersecurity professionals.
Studies referenced in the session suggested that millions of additional specialists are needed worldwide, yet only a fraction of that demand can currently be filled. Many security teams are overwhelmed by the sheer volume of alerts and data they must process.
This shortage has real consequences. When teams are stretched thin, patching is delayed, anomalies are missed and complex investigations become difficult to sustain. The panel emphasised that throwing more tools at the problem is not enough. Organisations must focus on training, automation and smarter operational processes.
Automation and AI-driven analysis were presented as essential enablers. Given the scale of modern mobile networks, it is simply not feasible for human analysts to monitor every signalling protocol, every core interface and every emerging technology manually.
Preparing for 2026
Looking ahead, the experts agreed on several broad trends. Attacks on legacy systems such as SS7 will continue. Fraudsters will increasingly target eSIM provisioning processes. VoLTE and 5G core components will face growing scrutiny. Satellite-based connectivity will introduce new and unfamiliar security questions.
Perhaps most importantly, the line between traditional telecom security and general cybersecurity will continue to blur. Mobile networks are now large, distributed IT platforms, and they inherit all the complexities that come with that transformation.
Operators, regulators and vendors must therefore adopt a holistic view. Investment must go beyond compliance reporting and focus on practical defences, real time monitoring and collaborative intelligence sharing.
Final Reflections
The SecurityGen webinar provided a valuable snapshot of an industry at a crossroads. Telecom networks are becoming more advanced and more capable, but also more complex and interconnected than ever before.
2025 demonstrated that attackers do not always need new vulnerabilities. Often they succeed simply by exploiting old weaknesses in smarter ways. The challenge for 2026 is to close those gaps while also preparing for the technologies that are only just beginning to emerge.
For those involved in telecom security, the full discussion is well worth watching. The complete webinar recording can be viewed below:
Point to point microwave radio systems have been with us for more than eighty years, yet they rarely attract much attention in an era where fibre dominates network planning and satellite systems continue to develop at pace. At a recent IET Anglian Coastal Local Network event, Prof. Andy Sutton delivered an excellent lecture that brought these fixed radio links back into the spotlight. His talk explored the history, engineering and future of microwave and millimetre wave links, reminding us why they remain essential for transmission networks in the UK and around the world.
The story begins with the national microwave radio network of the 1970s, with the BT Tower at its centre. These early deployments supported long links across the country and laid the foundation for many of the design principles still used today. While the landscape has changed significantly, the fundamentals of fixed radio communication continue to be shaped by spectrum availability, propagation characteristics and careful engineering.
Microwave links depend on a wide range of bands, from the lower 6 GHz region through to 80 GHz E-band. The choice of frequency affects everything from link length to susceptibility to atmospheric absorption. As Andy explained, a link designer must consider not just free space path loss, but also Fresnel zone clearance, rainfall intensity and antenna characteristics. The slides included a worked example that showed the impact of frequency and distance on the radius of the Fresnel zone and highlighted the need for adequate clearance to maintain availability over time.
The talk moved on to modern access radio systems, where compact rooftop nodes and all-outdoor radios have become common. These systems rely on careful use of vertical and horizontal polarisations, often enabled through XPIC technology. XPIC allows separate data streams to coexist on the same frequency using orthogonal polarisations, effectively doubling link capacity when conditions allow. This is paired with adaptive coding and modulation, which enables the radio to shift modulation schemes according to link quality. The result is a more resilient and efficient link compared to older fixed-modulation systems.
Capacity planning is a balancing act that involves radio channel bandwidth, modulation choice and the number of aggregated carriers. Wider channels and higher order modulation support multi-gigabit throughput, although this introduces penalties in transmit power and receiver sensitivity. The trade-offs are central to radio design and determine the type of equipment used, whether through a separate indoor and outdoor unit or an integrated all-outdoor system.
Andy also covered the practical elements of radio link planning, such as antenna selection, path profiling, waveguide losses and typical link budget calculations. A link planning example using a 32 GHz radio demonstrated the relationship between transmit power, antenna gain, free space loss and fade margin for a target availability of 99.99 percent. The discussion tied together the theoretical foundations with real-world engineering and illustrated how access radios are designed for street-level backhaul scenarios.
The lecture then moved to millimetre wave systems, particularly E-band radios that operate around 70 and 80 GHz. These links offer enormous capacity over shorter distances and are increasingly used for dense urban backhaul and enterprise connectivity. The slides included examples of network topologies showing how microwave and fibre can be combined to meet different deployment objectives.
A substantial part of the presentation focused on trunk or core microwave radio systems. These high-capacity, high-availability links support long distances and historically formed the backbone of national networks. Although demand for trunk links has reduced as fibre has spread, they still exist in challenging environments. In the UK, many trunk links remain operational in Scotland and island regions where terrain and geography limit fibre deployment. The lecture covered branching networks, duplexers, waveguide installations and space diversity techniques, all of which contribute to the reliability of long-haul links.
Looking ahead, research continues into new frequency bands, wider channels, higher modulation schemes and improved radio hardware. These advances will support even greater capacities, with millimetre wave links expected to reach 100 Gbps over short distances. Microwave radio may no longer be the headline technology it once was, but the field continues to push boundaries and remains an essential part of modern communication networks.
Andy’s lecture was a comprehensive tour of the past, present and future of point to point microwave systems. For anyone working in transmission, mobile networks or wireless engineering, it served as a valuable reminder of the depth of innovation in this area and its continued relevance in the broader ecosystem.
If you would like to explore the material in more detail, the slides from the event are available here and the video can be seen here. Both are well worth a look.
Our industry loves acronyms. In fact, sometimes it feels as if half our job is simply keeping up with them, while the other half is explaining them to everyone else. A recent example I saw referenced D2D for satellites, but expanded it as Device to Device instead of Direct to Device. Today, two similar acronyms are gaining momentum and are likely to become far more mainstream: AIoT and A-IoT.
Artificial Intelligence (AI) and the Internet of Things (IoT) are two of the key technological pillars of the modern digital world. IoT connects billions of devices, from sensors and cameras to industrial machinery, all producing vast amounts of useful data. AI enables these devices and systems to learn from this data, recognise patterns, predict outcomes, and act autonomously.
When these technologies come together, we get the Artificial Intelligence of Things, or AIoT. In simple terms, AIoT allows connected devices to analyse the data they generate and make decisions without always relying on central systems.
The intelligence in AIoT can sit in different places. Cloud based AI offers extensive processing power and the ability to leverage wider datasets. Edge AI processes data closer to where it is generated, enabling faster and more context aware decision making while reducing bandwidth use and protecting data privacy. Increasingly, lightweight machine learning models allow intelligence directly on devices themselves, enabling instant reactions without constant network access. This evolution transforms IoT devices from passive data collectors into proactive decision makers.
The benefits are significant. AIoT increases automation, improves efficiency, enhances reliability, and enables predictive maintenance, energy optimisation, autonomous navigation, and smarter logistics. It also supports sustainability initiatives, for instance by improving energy and water use monitoring or enabling more intelligent control of municipal utilities. In short, AIoT forms a key part of the digital transformation strategies emerging across industries.
To get a better sense of how AIoT could shape our everyday lives, I have embedded a couple of older Ericsson videos below that imagine a future where intelligence is seamlessly built into everything.
For anyone interested in going deeper into this topic, Transforma Insights and Supermicro have good explainers. While 3GPP continues to work on AI, ML and IoT, AIoT as a concept is largely implementation driven rather than a standardised feature in itself.
In contrast, 3GPP is actively defining a different acronym: A-IoT, short for Ambient IoT.
Ambient IoT represents a major shift in connected device design. Instead of relying on batteries or frequent charging, Ambient IoT devices operate using energy harvested from their surroundings. This can include radio signals, light, heat, or motion. The technology supports both passive operation, where devices backscatter incoming RF signals, and active operation, where they harvest enough power to generate and transmit signals independently.
Unlike traditional IoT devices, Ambient IoT units are extremely low power, low cost, and very simple in design. They have a shorter range and lower data throughput than conventional wireless technologies, but they excel in scenarios where massive numbers of tiny, battery-free sensors can be deployed and left to operate with minimal maintenance.
This makes Ambient IoT well suited to applications such as environmental sensing, supply chain tracking, inventory monitoring, smart agriculture, and intelligent labelling. It also opens opportunities in consumer environments, from smart packaging to indoor positioning. With the right network support, these devices can operate indefinitely, enabling sustainable, large-scale sensing networks.
Ambient IoT is already included in 5G Advanced Release 19. For those interested in learning more, 3GPP has a detailed overview, Oppo has produced an excellent white paper, and LG Uplus has published a forward looking document exploring Ambient IoT in the context of 6G.
Both AIoT and Ambient IoT represent the next phase of connected intelligence. AIoT pushes computation and decision making closer to where data originates, while Ambient IoT removes power barriers and enables pervasive, maintenance-free connectivity. Together, they will support systems that are scalable, energy efficient and context aware.
As these technologies mature, we can expect a world where devices are not only always connected, but also constantly learning, adapting, and operating independently with minimal energy demands. The future of connectivity lies in this balance between intelligence and efficiency, and both AIoT and Ambient IoT will play a crucial role in shaping it.
I have spent many years working in the Test and Measurement industry and have also worked as a hands on engineer testing solutions, and as a field engineer testing various solution pre and post deployment. Over the years I have used various attenuators and dummy loads. It was nice to finally look at the different types of dummy loads and understand how they work in this R&S video.
So what exactly is a dummy load? At its core, it is a special kind of termination designed to absorb radio frequency energy safely. Instead of letting signals radiate into the air, a dummy load converts the RF power into heat. Think of it as an antenna that never actually transmits anything. This makes it invaluable when testing transmitters because you can run them at full power without interfering with anyone else’s spectrum.
Ordinary terminations are widely used in test setups but they are usually only good for low power. If you need to deal with more than about a watt of power, that is where dummy loads come in. Depending on their design, they can handle anything from a few watts to many kilowatts. To survive this, dummy loads use cooling methods. The most common are dry loads with large heatsinks that shed heat into the air. For higher powers, wet loads use liquids such as water or oil to absorb and move heat away more efficiently. Some combine both air and liquid cooling to push the limits even further.
Good dummy loads are not just about heat management. They also need to provide a stable impedance match, usually 50 ohms, across a wide frequency range. This minimises reflections and ensures accurate testing. Many dummy loads cover frequencies up to several gigahertz with low standing wave ratios. Ultra broadband designs, such as the Rohde & Schwarz UBL100, go up to 18 GHz and can safely absorb power levels in the kilowatt range
Some dummy loads even add extra features. A sampling port allows you to monitor the input signal at a reduced level. Interlock protection can shut down a connected transmitter if the load gets too hot. These touches make dummy loads more versatile and safer in real-world use.
In day-to-day testing, dummy loads help not only to protect transmitters but also to get accurate measurements. By acting as a perfectly matched, non-radiating antenna, they give engineers confidence that they are measuring the true transmitter output. They can also be used to quickly check feedlines and connectors by substituting them in place of an antenna.
Rohde & Schwarz have put together a useful explainer video that covers all of this in a simple, visual way. You can watch it below to get a clear overview of dummy loads and why they matter so much in RF testing.
