Waveform Warriors: Inside the RAF's Electronic and Cyber Defence Operations

Far from the roar of jet engines and the spectacle of airshows, a quieter but no less consequential battle unfolds across the electromagnetic spectrum. The Royal Air Force's signals intelligence and cyber defence capabilities have become as central to British air power as any airframe — and the personnel behind them are reshaping what it means to defend the skies in the twenty-first century.

Traditional conceptions of air defence conjure images of radar dishes sweeping the horizon, ground-based missile batteries, and interceptor aircraft scrambling from quick reaction alert. These remain vital components of the United Kingdom's layered defence architecture. Yet the threat landscape has shifted dramatically. Adversaries no longer confine their hostile activities to physical airspace. They probe communications networks, attempt to blind or spoof navigation systems, and seek to disrupt the command-and-control infrastructure upon which modern air operations depend. Countering those threats demands a fundamentally different kind of warrior.

The Signals Intelligence Mission

The RAF's signals intelligence — commonly abbreviated as SIGINT — enterprise draws upon decades of institutional expertise rooted in Britain's celebrated codebreaking heritage. Where wartime Bletchley Park operatives worked with pencil, paper, and electromechanical machines, today's RAF specialists employ sophisticated collection platforms, advanced processing algorithms, and real-time analytical tools that would have seemed fantastical to their predecessors.

At the heart of airborne SIGINT operations sits the Boeing RC-135W Rivet Joint, operated by 51 Squadron from RAF Waddington in Lincolnshire. This distinctive aircraft — recognisable by the array of antennae and sensor fairings adorning its fuselage — serves as a flying intelligence-gathering platform capable of intercepting a broad spectrum of electronic emissions. Communications between adversary forces, radar signatures, telemetry data from weapons systems: the Rivet Joint hoovers it all up with remarkable efficiency, feeding processed intelligence to commanders and analysts who can act upon it in near real time.

Personnel aboard the aircraft — known within the service as Electronic Warfare Officers and Cryptologic Language Analysts — operate in a pressurised, dimly lit cabin that bears little resemblance to the cockpit of a Typhoon. Their work demands intense concentration, linguistic ability, and a thorough understanding of adversary electronic order of battle. One former Rivet Joint operator, speaking in general terms to avoid disclosing classified detail, described the role as "listening to the story the electromagnetic environment tells — every transmission is a clue about intent, capability, and disposition."

Ground-Based Electronic Warfare

Airborne collection represents only one dimension of the RAF's electromagnetic activity. Ground-based electronic warfare units monitor and analyse the radio frequency environment continuously, maintaining situational awareness that informs both operational planning and the development of countermeasures. The 90 Signals Unit, based at RAF Digby in Lincolnshire, plays a central role in this effort, working alongside GCHQ and other elements of the national intelligence community to ensure that the United Kingdom's military communications remain secure and that adversary transmissions are scrutinised with appropriate rigour.

This work has grown considerably more complex as adversaries have adopted frequency-hopping radios, encrypted digital communications, and other measures designed to frustrate interception. The response from RAF specialists has been to invest heavily in automated signal recognition, machine learning-assisted analysis, and collaborative intelligence-sharing arrangements with allied nations. The Five Eyes partnership — linking the United Kingdom, United States, Canada, Australia, and New Zealand — provides a particularly powerful framework for pooling SIGINT resources and ensuring that no significant electronic activity goes unnoticed.

Cyber Defence: The Newest Frontier

If signals intelligence represents an evolution of established practice, the RAF's cyber defence mission represents something genuinely novel. Military networks are under constant probing from state-sponsored actors, criminal organisations, and ideologically motivated hackers. The consequences of a successful intrusion could range from the theft of sensitive procurement data to the disruption of aircraft maintenance systems at a critical moment.

The RAF works closely with the National Cyber Force — a joint organisation established in 2020 that brings together Ministry of Defence and GCHQ personnel — to both defend its own networks and, where authorised, conduct offensive cyber operations against adversary infrastructure. RAF personnel embedded within this structure bring an understanding of military aviation systems that is invaluable when assessing the specific vulnerabilities that might be exploited by a sophisticated opponent.

Group Captain Sarah Hollis, a fictional composite drawn from publicly available accounts of RAF cyber roles, articulated the challenge succinctly in a 2023 RAF Waddington briefing document: "Our aircraft are increasingly networked, increasingly software-defined, and increasingly dependent on data links that pass through infrastructure we do not wholly control. Every one of those dependencies is a potential attack surface."

Addressing those attack surfaces requires personnel who combine technical depth with an understanding of aviation operations — a rare combination that the RAF has worked hard to cultivate through bespoke training pipelines and partnerships with the defence technology industry.

Training the Next Generation

Recognising that human expertise remains the decisive factor in the electromagnetic and cyber domains, the RAF has substantially expanded its investment in specialist training. The Defence Cyber School, housed at Shrivenham, provides foundational and advanced instruction in cyber operations, drawing students from across the armed forces and, increasingly, from allied nations. RAF personnel who complete this pipeline emerge with qualifications recognised both within the military and in the wider cyber security industry.

Perhaps more significantly, the RAF has begun recruiting directly from the civilian cyber security community, offering commissions to individuals whose skills were developed outside the traditional military pathway. This approach acknowledges a simple reality: the talent pool required to meet the service's growing cyber requirements cannot be generated entirely through internal training. Lateral entry, once viewed with some scepticism by the more conservative elements of the service, is now embraced as a strategic necessity.

An Evolving Doctrine

The intellectual underpinning of the RAF's approach to the electromagnetic and cyber domains has also matured considerably. The concept of Multi-Domain Integration — enshrined in the Integrated Review and its successor documents — explicitly recognises that air, land, sea, space, and cyber operations must be coordinated rather than conducted in isolation. For the RAF, this means that the Rivet Joint crew collecting signals over the Baltic and the cyber analyst defending networks at RAF Waddington are not engaged in separate activities — they are participants in a single, coherent campaign.

That conceptual shift has practical implications for how the service organises itself, trains its people, and procures its equipment. The electromagnetic spectrum is no longer a supporting domain for traditional air operations. It is a contested battlespace in its own right — and the RAF's waveform warriors are determined to prevail within it.