Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause Harmful Interference to Utility Fixed Microwave Links, Threatening Grid SCADA and Public-Safety Communications — Threadlinqs Intelligence
As of 2026-07-14, Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause Harmful Interference to Utility Fixed Microwave Links, Threatening Grid SCADA and Public-Safety Communications is a high-severity ics scada threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1337 · Severity: HIGH · Status: ACTIVE · Category: ICS_SCADA
Field testing by Southern Company Services, Lockard & White, and the Electric Power Research Institute (EPRI) near a Southern Co. 6 GHz fixed microwave link between Fortson and Columbus, Georgia found
The 6 GHz band (5.925-7.125 GHz) was opened by the FCC in April 2020 for unlicensed sharing with incumbent licensees, chiefly electric-utility, public-safety, and telecom fixed point-to-point microwave links that carry SCADA telemetry, grid-protection signaling, advanced metering infrastructure (AMI) backhaul, and first-responder communications. The FCC's coexistence framework relies on two device classes and one automated safeguard: Low-Power Indoor (LPI) devices, which operate license-exempt at reduced power with no location-awareness requirement, and Standard-Power / the newly proposed Geofenced Variable Power (GVP) devices, which must query an Automated Frequency Coordination (AFC) system built on the FCC's Universal Licensing System (ULS) incumbent database to avoid transmitting inside a software-defined exclusion zone drawn around each licensed link's beam path.
Field testing conducted by Southern Company Services, engineering firm Lockard & White, and EPRI physically validated what utility trade groups had argued analytically for years: LPI devices, which are exempt from any AFC check and are already sold at retail as ordinary routers, laptops, and cellphones, can and do cause harmful interference to licensed fixed microwave receivers when operated near a link's path. In the Fortson-Columbus, Georgia test, a single such device produced near-constant interference that took the monitored microwave link out of service for a cumulative total of tens of hours annually, roughly two orders of magnitude beyond the ~5-minutes-per-year unavailability standard that utility microwave networks are engineered to meet for SCADA and protective-relay traffic. Southern Co. filed the results with the FCC on June 23, 2026 under filing 106231367519302.
This interference risk is compounded by two structural gaps in the FCC's coexistence design. First, LPI devices are entirely outside the AFC/exclusion-zone protection scheme that governs Standard-Power and proposed GVP devices, so no database check or geofencing prevents an LPI unit from transmitting adjacent to a protected microwave receiver. Second, even for AFC-governed device classes, security researchers have published a GPS-spoofing attack (arXiv:2509.02824) against the location self-reporting used to place a device inside or outside an exclusion zone: an attacker with access to a Standard-Power/GVP access point can spoof its GPS-derived location to the AFC system, causing it to transmit at full power inside a zone the AFC believes is unoccupied, or evade detection as a 'rogue' outdoor access point — a threat vector Aviat Networks separately flags as 'extremely difficult to detect and resolve.' On January 7-8, 2026 the FCC announced it will vote on an Order creating the new GVP device category (up to 24 dBm EIRP) to further expand unlicensed 6 GHz use, over utility- and public-safety-sector objections that the AFC/ULS database is 'often seen to contain inaccurate or outdated location and antenna data,' undermining the exclusion-zone protections GVP depends on.
More than 40,000 licensed 6 GHz fixed-microwave links are deployed across the US, used for cellular backhaul, utility SCADA/telemetry, and public-safety/first-responder communications. On January 26, 2026, NRECA joined EEI, UTC, and APPA in a formal letter urging the FCC to immediately pause further certification of unlicensed 6 GHz LPI devices until rigorous, independent coexistence testing is completed, noting that LPI device manufacturers have refused to participate in or make devices available for such testing while simultaneously seeking FCC certification. The coalition is also asking the FCC to establish a cost-recovery mechanism so licensed utility operators can recoup the cost of identifying and mitigating interference once it occurs. This follows a 2020 legal fight in which utility groups (UTC, EEI, APPA) petitioned the FCC and later litigated in AT&T Services, Inc. v. FCC (D.C. Cir., No. 20-1190) seeking stronger 6 GH
Target sectors: energy, utilities, government administration, public-safety, telecoms
Target regions: united states of america
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ICS_SCADA, HIGH, threat intelligence, cybersecurity, T0860, T0814, T0804, T0803, T0826, T0829, T0837, T0880, T0813, T0815