The aircraft flew in places where someone was actively trying to interfere with it. Jamming, spoofing and interception were not theoretical risks; they were the operating conditions.

The existing design assumed a cooperative radio environment. Commands travelled over conventional channels, and there was no dependable way to prove that an instruction had come from the right operator, or that telemetry arriving on the ground had not been altered on the way.

We treated that as a trust problem rather than a bandwidth problem. Command-and-control and payload traffic were encrypted end to end, and every command was validated before it was acted on, so an injected or replayed instruction fails instead of flying.

Routing became a matter of policy. Traffic moves through nodes the operator has reason to trust, and the path can change as conditions do. Telemetry and payload data are cryptographically signed, so anyone downstream can check what they are looking at.

The system also has to keep working badly before it stops working altogether. Partial signal loss or the failure of a single node degrades performance rather than ending the sortie.

The practical outcome is that the operator can say, with evidence, who issued a command and whether the data is genuine. That is what makes the platform usable in contested airspace.