THE BEARING RX // PASSIVE BAND 4.9–6.0 GHz --:--:-- UTC
Feline Union // signals desk // working instrument

A direction
is not a
position.

One antenna gives you a bearing: a line out to the horizon, an emitter somewhere along it, no distance. Useless on its own. But a phased-array tile is cheap now, and a camera network is already a grid of fixed points. Cross two bearings and the lines meet. Cross four and the meeting becomes a fix. The mesh is the threat, not the tile.

Instrument I–III Method angle-of-arrival Solver least-squares intersection Posture receive only
drag the emitter. watch the lines decide where you are.
ACT I

Bearings into a fix

A single tile resolves which way, never how far. Geolocation is not a property of the antenna. It is a property of the network the antenna is bolted to. Drag the emitter below and watch separated nodes turn directions into a point.

DF-SCOPE // 4×4 MIMO phased array click+drag emitter · click empty space adds a node
With one node there is only a bearing: an emitter anywhere along that line fits equally well. Raise the node count and the lines start to disagree productively. The point where they least-disagree is you.

Watch what the error readout does as you add nodes. One node: there is no error number, because there is no fix, only a direction. Two nodes: a fix appears but it skews wildly as you drag along certain angles. Four well-spread nodes: the fix locks to a few metres and barely flinches.

That is the entire argument in one motion. The phased-array tile contributes a bearing and nothing more. Everything that makes a bearing dangerous, the distance, the point, the dot on a map an officer can dispatch to, comes from separation between nodes and from correlation across them. A surveillance camera network already ships both. It is a grid of fixed, surveyed, time-synchronised points that already pool their observations into one dashboard. Adding receive-only DF tiles inherits that topology for free.

The scary capability was never in the device on the pole. It was in the map that already joins every pole together.

Notice the second readout: geometry quality. When all nodes sit on one side of the emitter, the bearings cross at a shallow angle and the fix smears into a long ellipse, even with low per-bearing noise. Spread the nodes around the target and the same noise collapses to a tight point. This is why coverage density, not sensor sensitivity, is the real escalation. A city does not need better antennas. It needs more poles, and it already has them.

ACT II

The key that follows you out of the car

Geolocation tracks an emitter. The privacy collapse needs a persistent identity for that emitter. A licence plate is a stable pseudonymous key for a car. A radio's physical-layer fingerprint is the same kind of key for a device, and the device is in your pocket.

Key A · the car

PLATE · 7HXJ·482
Stability across reads: 100% · plate does not rotate

Key B · the device

RF · —
Stability across reads: · survives MAC rotation:
MAC randomisation is the defence everyone names. Watch whether it touches Key B.
Two pseudonymous keys, two separate graphs. Key A is seen at nodes by plate. Key B is seen at the same nodes by fingerprint. They have not been linked.

The naive version of device tracking reads a MAC address off a probing phone. Modern handsets defeat that by rotating the MAC to a random value, so the obvious identifier melts between reads. Press Rotate MAC above: Key B's address changes, and a system that keyed on the address loses the trail.

But the address is the logical layer. The physical layer does not rotate. Every radio has manufacturing imperfections, oscillator drift, clock skew, power-amplifier nonlinearity, that bias its emissions in a way that is stable for the life of the hardware. Take enough reads and those imperfections form a fingerprint that survives the MAC change. Press Take another read and watch the fingerprint bars reconverge while the address keeps lying.

Plate is to car as RF fingerprint is to device. Both are stable pseudonymous keys. Both become a name the moment they sit at the same nodes as something already named.

Now press Join the graphs. A stable device key, repeatedly co-located with a stable plate key at the same poles at the same times, joins the two. The car was never the point. The car was the introduction. After the join, the device follows the person: out of the car, into the building, onto the bus, to the meeting, home. The plate is forensic. The fingerprint is biographical.

ACT III

The rule contemplates only the transmitter

The vendor disclaimer that looks like a constraint, not intended for radar applications, points the wrong way. It governs transmitting. Every capability above is receiving. The regulation never imagined the passive case, because until tiles got cheap, passive mass collection was not worth worrying about.

▲ Transmit · regulated

What the rule sees

Active radar means emitting energy into licensed or shared spectrum. That is the act the emission rules govern: power limits, band authorisation, interference, licensing.
  • Requires authorisation in band
  • Causes measurable interference
  • Detectable, attributable to a transmitter
  • The disclaimer's actual subject
"Not intended for radar applications" is a statement about emitting. It is load-bearing, in the opposite direction from how it reads.
● Receive · unaddressed

What the rule misses

Direction-finding, fingerprinting, and pattern-of-life are all done by listening. No energy is emitted. The transmit-licensing regime has nothing to grip.
  • Emits nothing, authorises nothing
  • Causes no interference to flag
  • Silent, attributable to no one
  • The entire surveillance use case
The gap is not an oversight to patch. It is the structure: harm was modelled as emission, so absence of emission reads as absence of harm.
The disclaimer is irrelevant to the surveillance scenario, and that irrelevance is the more damning fact. The rulebook only knows how to see a transmitter. A passive listener that maps a city's devices breaks no emission rule because it makes no emission. The cheapness of the tile is what moved passive mass collection from theoretical to deployable, and the law that should meet it was written for a different physics.

The same asymmetry runs through the constitutional posture, not just the spectrum rules. A camera network's standing defence is the public-exposure logic: a plate faces the street, a car on a road has a reduced expectation of privacy, the system only logs what any bystander could see. That argument is built for plates.

It fits a passively-collected fingerprint of a device in your pocket far worse. The signal is not knowingly exposed the way a plate bolted to a bumper is. And aggregated location drawn from a personal device, accumulated across nodes into a pattern of life, is precisely the category that courts have already flagged as different in kind from a single observation. The fingerprint-plate join does not extend the old defence. It walks the system into the territory the old defence was built to stay out of.

Plate
Knowingly exposed to public view. Strong fit for the public-exposure defence.
RF fingerprint
Emitted from a device in a pocket, not knowingly exposed in the same sense. Weak fit.
Single read
One observation, one moment. The bystander analogy holds.
Aggregated pattern
Pattern-of-life across nodes over time. Different in kind, the category courts have fenced.
Transmit
Regulated act. Authorisation, power limits, interference.
Receive
Unaddressed. Emits nothing, so the emission regime has nothing to hold.
A bearing is a question. The mesh is the answer. The rulebook only knows how to fine a transmitter, and nobody here is transmitting.
THE BEARING · an instrument, not a forecast
Feline Union signals desk · primary sources, mechanisms not individuals, no intent without receipts
Method: angle-of-arrival simulated with additive bearing noise · fix by least-squares intersection · fingerprint stability is an illustrative decay model, not a measured device
Built to be argued with. Find the error, send the correction.
Standing on
  1. Phased-array / MIMO software-defined radio tiles in the ~4.9–6.0 GHz band as the affordable direction-finding primitive (vendor product family; pin exact SKU before publication).
  2. Camera/ALPR networks as a pooled, cross-jurisdiction database model rather than a single sensor (ACLU Massachusetts, Data for Justice Project, 2025).
  3. Real-time crime-center platforms unifying LPR, video, drones, gunshot detection, CAD/RMS/911 and location into one map (vendor product literature).
  4. RF / physical-layer device fingerprinting surviving MAC randomisation via hardware imperfection (clock skew, oscillator drift, PA nonlinearity) — established in the wireless-security literature.
  5. Carpenter v. United States (2018) on aggregated location from personal devices as constitutionally distinct from single public observations; Katz on knowing exposure.
Feline Union // signals desk // take action

Make someone write the rule

The instrument above is buildable today, and the rulebook only knows how to fine a transmitter. Closing that gap is a job for the people who write the spectrum and privacy laws. Enter a postal code: this looks up your federal MP and your provincial member and opens a pre-written, editable email. Nothing is stored here.

Lookup by Represent (Open North). Your postal code is sent only to that civic API to find your districts, never to this site. The email opens in your own mail app for you to edit and send.

Feline Union // signals desk // transmit

Cross a bearing into a fix

Ten lines, each one true on its own. Post one, or copy it and add your own. A single share is a bearing; enough of them resolve a position.

▶ NARRATION 3 VOICES · 5:55 conversational walkthrough · tap to open
0:00 / 5:55
Investigator Press play. The page will follow along, scrolling to each act as the discussion reaches it.