Case study · Transport infrastructure · National scale

Cable theft tracking and recovery at national scale

Squared Technologies was engaged to help a major UK public transport operator and its operational partners reduce the time lost to cable theft incidents. The goal was not security theatre. The goal was earlier certainty, cleaner evidence, and faster recovery outcomes, without publishing tactics that adversaries can learn from.

The problem

Cable theft on rail is not a nuisance crime. It is disruption of critical infrastructure. Rail systems are designed to fail safe for good reasons, but that safety behaviour creates an uncomfortable asymmetry: a small physical compromise can trigger a disproportionate operational impact. When signalling and power infrastructure is affected, the first response is often dominated by uncertainty. Teams know something is wrong, but not necessarily where, not necessarily what has moved, and not necessarily which actions will restore service fastest.

In practice, the cost is not the scrap value. The cost is the operating day. Cascading delay minutes, crew displacement, pathing knock-on effects, and missed asset rotations compound quickly. The longer it takes to confirm what happened and where it happened, the more expensive the recovery becomes. Traditional mitigations were already in play, including physical hardening, patrols, signage, and established incident processes. The gap was time-to-certainty and the quality of evidence created in the first critical window.

The brief was therefore outcome-led. The operator wanted faster confirmation, better localisation context, and an evidence trail that would stand up internally and externally. Just as importantly, the solution had to assume adversarial behaviour. Anything that relied on perfect connectivity, predictable conditions, or an attacker who does not adapt would eventually fail.

How we approached it

Squared Technologies treated the challenge as an operational programme, not a gadget. The objective was to collapse the time spent searching and to remove ambiguity from the early response phase. That drove two engineering principles. First, the system must be resilient in messy environments, including attempted disruption and interference. Second, the telemetry must be evidence-grade, meaning it should create a consistent, timestamped history that can be reconstructed without guesswork.

We also adopted a strict disclosure posture. The public description of this work focuses on outcomes, not tactics. Threat actors read public material. The right public posture is credibility without a blueprint. Detailed mechanics, deployment specifics, and adversary-facing assumptions are intentionally not published.

The programme was designed to fit real response workflows. If an alert is noisy, people will ignore it. If information arrives too late, it is irrelevant. If the system requires a specialist to interpret during an incident, it adds friction rather than removing it. The design therefore focused on clarity: signals that correlate strongly with incidents, event history that can be searched quickly, and cues that match how teams operate in the field.

The solution

The delivered system combines discreet field telemetry, reliable collection across difficult environments, and a secure platform designed for operational evidence rather than best-effort dashboards. At the field layer, Squared Technologies used extremely low-power sub-GHz RF telemetry, including the 433 MHz band where it provides practical advantages for penetration and behaviour in complex environments. In rail and infrastructure deployments, geometry and materials matter. Sub-GHz engineering can provide the margin that turns an intermittent concept into a reliably operating system.

The system was engineered to remain useful under imperfect conditions. That means it is designed to keep producing operational value even when the environment is hostile, including situations where interference or attempted disruption is present. We do not make absolute claims that a system cannot be jammed, because that is not a credible engineering statement. What we do build is a system that is resilient by design, that reduces single points of failure, and that is focused on operational outcomes rather than laboratory assumptions.

On the platform side, the telemetry was normalised into an evidence-grade event history. The practical benefit is simple: when an incident is disputed or investigated, teams can produce a coherent timeline. What was detected, when it was detected, what conditions were observed, what actions were taken, and what the outcome was. That history also enables operational learning: measuring detection latency, dispatch latency, restoration time, and repeat patterns across locations.

Deployment was staged deliberately. A representative initial rollout validated behaviour and refined thresholds so the system did not become an alarm generator. Once outcomes were proven and operational confidence was established, the deployment expanded. The objective was repeatability at national scale: consistent behaviour, consistent data, consistent response cues.

Results and conclusion

The impact was measured in operational terms. Detection moved earlier in the incident lifecycle. Location context improved, which reduced time spent searching and narrowed response to where it mattered. Evidence capture became consistent and reviewable, which improved internal reporting and supported external processes where appropriate. Most importantly, the operator gained a more controlled response posture: fewer wasted dispatches, fewer hours lost to uncertainty, and improved recovery potential because the critical window after an incident was no longer dominated by guesswork.

This work is not a claim that cable theft disappears. In adversarial environments the objective is operational advantage: reduce the attacker’s window, improve the probability of recovery, and improve the quality of evidence and response. That is how a programme moves from reactive firefighting to managed resilience.

Squared Technologies continues to invest in this category because it sits at the intersection of RF engineering, real-world deployment, and evidence-grade platforms. It is exactly the type of problem where full-stack engineering matters: hardware, RF, firmware, and platform are one system. If you operate rail, fleet, highways, or similarly distributed infrastructure and want a high-level conversation about theft detection, recovery outcomes, and evidence-grade telemetry, talk to engineering.