All modern communication systems—from tactical handheld radios (VHF/UHF) and cellular base stations to drone telemetry links and satellite command uplinks—operate by propagating electromagnetic waves through the physical atmosphere.

While state military intelligence agencies deploy classified SIGINT aircraft and satellite intercept constellations to locate adversary transmitters, the democratization of Software-Defined Radio (SDR) hardware and open-source digital signal processing (DSP) toolchains has made Radio Frequency Direction Finding (RF DF) accessible to independent researchers, journalists, and human rights monitors.

Whether investigating the source of GPS spoofing signals disrupting civilian aviation, locating illegal pirate propaganda transmitters, or verifying military radio chatter along contested borders, open-source signals intelligence provides an objective physical anchor for field investigations.

This manual details the fundamental physics of radio propagation, the construction of portable SDR direction-finding kits, and the mathematical triangulation methodologies required to locate unknown RF emitters.

1. Principles of Radio Direction Finding (RDF)

Radio Direction Finding is the art and science of determining the geographical bearing of an active electromagnetic transmitter from one or more receiving listening posts:

                            DIRECTION FINDING PARADIGMS
                                         │
           ┌─────────────────────────────┴─────────────────────────────┐
           ▼                                                           ▼
    AMPLITUDE-BASED (AOA)                                   TIME-BASED (TDOA)
  • Single movable receiver                               • Multi-station synchronized mesh
  • Measures signal peak/null with directional antenna    • Measures nanosecond arrival offsets
  • Computes Line of Bearing (LoB)                        • Generates intersecting hyperbolic curves
  • Ideal for tactical field tracking                     • Ideal for fixed regional SDR networks (KiwiSDR)

The Angle of Arrival (AoA) Model

A single investigator equipped with a portable receiver and a directional antenna rotates the antenna through $360^\circ$ of azimuth: * When the antenna elements align directly with the incoming wavefront, the received signal strength (RSSI) peaks. * By drawing a compass line along the antenna’s pointing axis, the investigator establishes a Line of Bearing (LoB).

The Time Difference of Arrival (TDOA) Model

Instead of rotating antennas, multiple geographically dispersed software-defined radios record the identical digital radio burst simultaneously: * Because radio waves travel at the speed of light ($c \approx 299,792\text{ km/s}$), a transmitter located closer to Station A than Station B produces a minute nanosecond time offset ($\Delta t$). * Plotting points of constant time difference forms a hyperbola; intersecting three hyperbolas pinpoints the transmitter coordinate without human antenna adjustments.

2. Hardware Architecture for Field Investigators

Field-grade RF monitoring no longer requires $100,000 military receivers. Open-source investigators deploy modular, off-the-shelf components:

┌────────────────────────────────────────────────────────────────────────┐
│               PORTABLE FIELD SDR INVESTIGATION TOOLCHAIN               │
├────────────────────┬────────────────────┬──────────────────────────────┤
│ 1. RF Frontend     │ 2. Antennas        │ 3. Processing Core           │
│ RTL-SDR v4 ($35)   │ Directional Yagi   │ Hardened Linux Laptop        │
│ HackRF One ($300)  │ Log-Periodic (LPDA)│ GQRX / SDR++ / GNU Radio     │
│ KrakenSDR ($400)   │ Magnetic Loop      │ GPS USB Dongle (NMEA sync)   │
└────────────────────┴────────────────────┴──────────────────────────────┘

The Antenna Selection Matrix:

• Yagi-Uda Array: Provides intense forward gain ($9\text{ dBi} - 14\text{ dBi}$) over narrow frequency slices (e.g., 433 MHz or 915 MHz). Excellent for tracking drone control links or handheld transceivers.
• Log-Periodic Dipole Array (LPDA): Operates across a vast frequency spectrum (typically 700 MHz to 6 GHz) with moderate directional gain. Ideal for sweeping unknown cellular and Wi-Fi emissions.
• Shielded Magnetic Loop: Operates in the HF spectrum (3 MHz to 30 MHz). Its sharp $90^\circ$ directional “nulls” allow investigators to eliminate high-power background noise and pinpoint distant shortwave state propaganda stations.

3. The Triangulation Workflow: Plotting Lines of Bearing (LoB)

A single Line of Bearing proves that a transmitter lies somewhere along an infinite ray; establishing its exact location requires geometric triangulation:

                                  [EMITTER TARGET (?)]
                                       *
                                      / \
                                     /   \
                         LoB A      /     \     LoB B
                                   /       \
                                  /         \
                            [STATION A]   [STATION B]
                              (Origin)      (Baseline)

The 4-Step Triangulation Field Protocol:

1. Establish Baseline Listening Post A:
2. Record geographic GPS coordinates of Station A.
3. Connect directional antenna to SDR running SDR++ or GQRX.
4. Rotate antenna until the signal waterfall displays peak signal-to-noise ratio (SNR).
5. Record True Compass Bearing (e.g., $042^\circ$). Draw Ray A extending from Station A.
6. Reposition to Listening Post B:
7. Travel perpendicular to the first Line of Bearing by at least 1 to 5 kilometers to establish a wide geometric baseline.
8. Record GPS coordinates of Station B.
9. Sweep and rotate antenna to re-acquire the identical signal frequency and waveform modulation.
10. Record True Compass Bearing (e.g., $315^\circ$). Draw Ray B extending from Station B.
11. Compute the Intersection:
12. The mathematical intersection of Ray A and Ray B defines the estimated transmitter location.
13. Third Verification Post C (The “Cut”):
14. A third observation post generates Ray C. In real-world urban and mountainous terrain, multipath reflections prevent rays from intersecting at an exact single point; they form a triangle of error (error ellipse). The physical transmitter lies within this bounded polygon.

4. Distributed TDOA via Open Crowdsourced Networks: KiwiSDR

For regional high-frequency (HF / Shortwave: 1 MHz to 30 MHz) investigations—such as military strategic command broadcasts, diplomatic numbers stations, or naval radar pulses—investigators use the KiwiSDR Global Network.

[INVESTIGATIVE WORKSTATION] ────► [KIWISDR TDOA SERVER]
                                          │
            ┌─────────────────────────────┼─────────────────────────────┐
            ▼                             ▼                             ▼
     SDR RECEIVER 1                SDR RECEIVER 2                SDR RECEIVER 3
     (Helsinki, FI)                (Warsaw, PL)                  (Kyiv, UA)
            │                             │                             │
            └─────────────────────────────┼─────────────────────────────┘
                                          ▼
                            [CROSS-CORRELATION MATRIX]
                                          ▼
                         [HEATMAP HYPERBOLA INTERSECTION]

Executing a KiwiSDR TDOA Run:

1. Identify the target transmission frequency (e.g., 4625 kHz “The Buzzer” or military digital data link).
2. Select 4 to 6 publicly accessible KiwiSDR nodes surrounding the estimated geographical theater, ensuring all selected receivers have stable GPS 3D position lock.
3. Ingest synchronous I/Q raw baseband audio across all nodes.
4. The TDOA server executes cross-correlation algorithms, computing the phase difference of arrival between receiver pairs.
5. A color-coded probability heatmap renders over a satellite map, constraining the transmitter’s position to within a few tens of kilometers.

5. Identifying Illicit Emitters: Signal Classification

Once a signal is intercepted, investigators classify the modulation scheme using digital signal analysis:

6. Operational Security for Radio Hunters

Transmitting radio waves emits a beacon that can be tracked; however, passive reception is completely silent. Nevertheless, field investigators must safeguard their operations:

• Shielded Cables: Always use double-shielded coaxial cables (such as RG-400 or LMR-400) to prevent the SDR itself or nearby laptop CPU clock noise from generating phantom signals.
• Local Law Compliance: In authoritarian jurisdictions, possessing directional antennas and software-defined radios can be criminalized as espionage. Conceal antenna elements inside standard backpacks or use compact magnetic loop antennas when conducting field audits.
• Cryptographic Archiving: Record raw I/Q baseband files rather than lossy MP3/WAV audio. Raw I/Q data preserves the exact RF phase and amplitude, allowing independent laboratories to verify your signal findings.

By mapping invisible electromagnetic waves into precise geographic coordinates, open-source researchers ensure that electronic warfare and covert transmissions cannot operate in absolute darkness.