How Underground Fiber Optics Turn Your City Into a Living Intrusion Sensor

Every city sits on a mesh of underground fiber optic cables—installed for telecom, but capable of much more. A growing number of intrusion detection teams are learning to repurpose that existing infrastructure as a distributed vibration sensor. The technique is called distributed acoustic sensing (DAS), and it turns a standard fiber into a continuous array of virtual microphones. When someone digs, walks, or drives near the buried cable, the fiber's backscatter pattern changes, and you can pinpoint the disturbance with meter-level accuracy.

This article is for security engineers, physical security managers, and SOC analysts who already know the basics of perimeter detection and want to evaluate whether fiber-optic sensing makes sense for their environment. We will skip the beginner primer on how fiber works and go straight to the trade-offs practitioners care about: installation gotchas, false alarm management, signal processing choices, and integration with existing alarm systems.

1. Why This Topic Matters Now

The threat landscape for critical infrastructure has shifted. Attackers no longer limit themselves to cyber intrusions; physical sabotage of underground utilities—power lines, gas pipelines, water mains, and data trunks—has become a documented tactic. In many cities, the same conduits that carry your internet traffic also carry high-voltage power or natural gas. A single dig-in by a malicious actor can cause cascading failures across multiple sectors.

Traditional buried intrusion sensors exist—seismic geophones, buried coaxial cable sensors, and pressure-sensitive mats—but they are expensive to install, require dedicated trenching, and cover only a narrow corridor. Fiber optic cables, by contrast, are already in the ground under nearly every street. The cost to activate them as sensors is mostly in the interrogator unit and the signal processing software. For security teams with existing fiber leases or owned dark fiber, the marginal cost can be surprisingly low.

Many industry surveys suggest that the number of attempted physical intrusions at utility substations and telecom huts has risen steadily over the past five years. At the same time, DAS technology has matured: interrogators that once cost six figures are now available for under $50,000, and open-source processing libraries have cut the software barrier. The convergence of these trends makes now a practical time to evaluate fiber-optic intrusion detection.

There is also a regulatory angle. In some jurisdictions, critical infrastructure operators are required to monitor for unauthorized digging near their assets. A fiber-based system can provide continuous, automated monitoring without the labor cost of patrols. Early adopters in the energy sector have reported catching several excavation attempts before any damage occurred.

But the technology is not a silver bullet. The rest of this article will help you decide where it fits in your detection stack, and where it does not.

Who Should Read This

This guide is written for security professionals who are already familiar with physical intrusion detection concepts—zone-based alarms, tripwires, and video analytics. If you have never deployed a buried sensor, you may want to start with a primer on perimeter detection basics first. Here, we focus on the advanced nuances of fiber-based sensing.

2. Core Idea in Plain Language

Distributed acoustic sensing works by sending a laser pulse down a fiber and measuring the tiny amount of light that scatters back (Rayleigh backscatter). When the fiber is disturbed by a vibration—a footstep, a shovel strike, a vehicle driving overhead—the backscatter signature changes. By timing the return of the scattered light, the interrogator can locate the disturbance along the fiber. In effect, the entire cable becomes a series of contiguous vibration sensors, with each virtual sensor spaced anywhere from one to ten meters apart.

The key advantage is coverage. A single interrogator can monitor up to 50 kilometers of fiber, depending on the system and fiber quality. That is far more than any array of discrete geophones could cover at comparable cost. The fiber itself is passive and requires no power along its length, making it ideal for remote or hazardous areas.

The catch is signal interpretation. A fiber cannot tell the difference between a malicious dig and a legitimate construction crew working nearby, unless you train a classifier on the vibration signature. This is where machine learning enters the picture. Modern DAS systems use neural networks to distinguish between excavation, walking, vehicle traffic, and environmental noise like wind or rain.

Another nuance is that the fiber must be mechanically coupled to the ground. A loose fiber in a conduit will not pick up ground vibrations well; it needs to be in direct contact with the soil or attached to a buried structure. This is why many DAS deployments use fibers that are buried in the same trench as a pipeline or power cable, or are installed in a dedicated shallow trench with backfill compacted around them.

The physics is well understood—the same Rayleigh scattering principle is used in optical time-domain reflectometry (OTDR) for fault location. DAS simply uses a coherent laser and faster digitization to capture the phase changes caused by strain. The result is a continuous stream of vibration data that can be analyzed in real time.

A Simple Analogy

Imagine a long rope lying on the ground. If you tap the rope at one point, the vibration travels along it. A DAS interrogator is like a person holding one end of the rope and feeling for vibrations. By measuring how long it takes for the vibration to reach them, they can tell how far away the tap occurred. With a sensitive enough hand, they can even tell whether the tap was a finger, a foot, or a shovel. The fiber is the rope, the laser is the hand, and the signal processing is the brain that interprets the vibration patterns.

3. How It Works Under the Hood

At the physical layer, a DAS interrogator contains a narrow-linewidth laser, an optical modulator, a photodetector, and a high-speed digitizer. The laser emits a coherent pulse (typically 10–100 nanoseconds long) at a repetition rate of thousands to tens of thousands of pulses per second. The pulse travels down the fiber, and the backscattered light is mixed with a local oscillator (the same laser's output) to extract the phase via homodyne or heterodyne detection.

The phase information encodes the strain applied to the fiber at each point. When a vibration compresses or stretches a short segment of fiber, the optical path length changes, and the phase of the backscattered light shifts. By comparing successive pulses, the interrogator can measure the rate of phase change, which corresponds to the vibration frequency and amplitude.

The spatial resolution is determined by the pulse width and the digitizer sampling rate. A 50-nanosecond pulse gives roughly 5-meter resolution; a 10-nanosecond pulse gives about 1 meter. The trade-off is that shorter pulses have lower signal-to-noise ratio because they carry less energy. In practice, most intrusion detection applications use 5–10 meter resolution, which is sufficient to locate a digging event within a few meters.

The raw data from the interrogator is a time series of strain rate (or phase) for each gauge length along the fiber. This is a massive data stream—a 10-km fiber with 5-meter spacing and a 10-kHz sampling rate produces 20 million data points per second. Onboard processing reduces this to event metadata: time, location, frequency content, and amplitude. Machine learning models then classify the event type.

Key Components

• Interrogator unit: The laser, receiver, and processing computer. Typically rack-mounted and powered from a utility room or hut.
• Sensing fiber: Standard single-mode telecom fiber works, but the quality matters. High attenuation or many splices can reduce the range.
• Backhaul network: The interrogator needs to send alerts to a central monitoring station. This can be over Ethernet, cellular, or even the same fiber if you use a different wavelength.
• Analysis software: Includes event detection, classification, and integration with physical security information management (PSIM) systems.

Signal Processing Pipeline

The typical pipeline starts with a moving average filter to remove low-frequency drift (e.g., thermal expansion). Then, a short-time Fourier transform (STFT) converts the time-domain signal into spectrograms for each gauge section. A pre-trained convolutional neural network scans these spectrograms for patterns characteristic of human activity. Digging produces a distinct signature: a series of low-frequency impacts (2–20 Hz) with occasional high-frequency spikes when metal hits rock. Walking is a more regular pattern around 1–2 Hz. Vehicle traffic is broadband but continuous.

False positives are the main operational challenge. Rain, wind, and road traffic can all create vibration patterns that look like intrusion. The best systems use multi-channel correlation (e.g., two fibers in the same trench) and time-of-arrival differencing to reject non-threatening vibrations. Some also incorporate weather data to adjust sensitivity.

4. Worked Example or Walkthrough

Let us walk through a typical deployment scenario. A mid-sized electric utility wants to monitor a 15-km stretch of underground transmission cable connecting two substations. The cable runs in a concrete-encased duct bank about 1.5 meters deep. There is already a dark fiber pair in the same duct bank, owned by the utility's internal telecom division.

Step 1: Fiber assessment. The team uses an OTDR to measure the fiber's loss and identify splices or bends. The total loss is 6 dB, which is acceptable for DAS. They notice one splice with 0.5 dB loss and a few sharp bends near a manhole. They decide to use the other fiber in the pair as a backup and to provide spatial diversity.

Step 2: Interrogator placement. The interrogator is installed in a climate-controlled cabinet at Substation A. It connects to the fiber via a patch panel. The team configures the interrogator with a pulse width of 50 ns (5-meter resolution) and a repetition rate of 10 kHz. They set the maximum range to 20 km to leave margin.

Step 3: Baseline collection. For the first week, the system runs in learning mode, recording vibrations without generating alarms. The software builds a model of normal activity: passing vehicles on a nearby road, wind through nearby trees, and occasional maintenance work. The team manually labels any events they can identify from logs or camera footage.

Step 4: Alarm threshold tuning. After a week, the team reviews the false positive rate. They find that heavy rain causes widespread low-frequency noise that triggers many alerts. They add a rain sensor input that reduces sensitivity during precipitation. They also create a geofence around a construction site 2 km away, suppressing alarms from that zone during working hours.

Step 5: Integration. The DAS system outputs alarms via SNMP traps to the utility's existing SCADA and PSIM systems. Each alarm includes a timestamp, GPS coordinate (converted from fiber distance), event type (dig, walk, vehicle), and confidence score. The SOC operators can view a spectrogram of the event to make a manual call if needed.

Outcome. In the first three months, the system detected four unauthorized digging attempts near the cable route. Two were construction crews working without a permit; two were attempted theft of copper grounding wire. The false alarm rate stabilized at one per week, mostly from road work. The team considered that acceptable.

Trade-offs in This Scenario

The utility could have used buried coaxial cable sensors instead, but the cost would have been higher because they would need to trench a dedicated sensor line alongside the cable. Using existing dark fiber saved approximately 60% of the installation cost. On the other hand, the fiber in the duct bank is less sensitive than a direct-buried fiber because the concrete encasement dampens vibrations. The team accepted this lower sensitivity because the threat was excavation, which generates strong vibrations.

5. Edge Cases and Exceptions

Not every fiber installation works well for DAS. The most common failure mode is poor mechanical coupling. Fibers that are loosely coiled in a vault or running through a conduit with air gaps will not transmit ground vibrations efficiently. In extreme cases, the fiber may be inside a gel-filled tube that absorbs vibration. A quick test is to tap the ground above the fiber while watching the DAS trace; if the tap is barely visible, coupling is poor.

Another edge case is fiber that passes through highly urbanized areas with heavy traffic. The constant vibration from buses and trucks can saturate the sensor, making it hard to detect subtler signals like footsteps. Some practitioners use adaptive gain control to reduce sensitivity in high-traffic zones, but this can also mask intrusion attempts that coincide with traffic.

Temperature drift is a well-known issue. As the fiber heats up during the day, the refractive index changes, causing a slow phase shift that can look like a strain event. The solution is to subtract a low-pass filtered version of the signal, but this also removes very slow intrusion signals like someone crawling. For this reason, DAS is better suited for detecting discrete, impulsive events than for detecting slow, continuous pressure.

Power and connectivity at the interrogator location can also be a problem. Interrogators draw 100–500 watts and need a stable network connection. In remote substations, this may require solar panels and cellular backup. Some vendors offer low-power interrogators that use pulsed lasers with lower repetition rates, trading off sensitivity for power savings.

Finally, there is the issue of fiber length. Beyond about 50 km, the signal-to-noise ratio degrades because of attenuation and nonlinear effects. Longer distances require repeaters or amplification, which adds cost and complexity. Most urban deployments stay under 30 km.

When Not to Use DAS

• When the fiber is in a conduit with no direct soil contact.
• When the required detection zone is less than 100 meters and a simpler sensor (e.g., buried coaxial cable) would suffice.
• When the environment has constant high vibration (e.g., next to a railway) and cannot be filtered without losing sensitivity.
• When the budget cannot accommodate the interrogator cost (still $30k–$80k) and the ongoing software licensing.

6. Limits of the Approach

Even with perfect coupling, DAS has fundamental limitations. The first is that it detects vibration, not the presence of a person. A person standing still on the surface generates almost no vibration. If an intruder walks slowly and then stops, the system will detect the approach but lose them when they freeze. This makes DAS better as a tripwire than as a tracking sensor.

The second limit is discrimination. While machine learning can distinguish digging from walking with high accuracy, it struggles with novel events—like a person using a pneumatic drill for the first time. The system may classify it as road work and ignore it. Continuous model retraining is necessary to keep up with new threat tactics.

Third, DAS cannot tell you who is there. It provides location and activity, but not identity. You still need cameras or guards to confirm and respond. The value of DAS is in reducing the number of false alarms sent to those cameras, so that operators can focus on real threats.

Cost is another limit. While the fiber itself is often free (if you already own it), the interrogator and software can be a significant capital expense. Some vendors charge annual licensing fees for the classification algorithms. For a small site with only a few kilometers of fiber, the cost per meter can be higher than alternative sensors.

Finally, DAS is sensitive to fiber health. A single fiber cut or a bad splice can render the entire system inoperable until repaired. Redundant fiber paths are recommended but not always available. The interrogator itself is a single point of failure; if it goes down, all monitoring stops. Backup interrogators are rare in practice due to cost.

Comparison with Other Buried Sensors

7. Reader FAQ

Can I use any fiber optic cable for DAS?

Standard single-mode fiber (G.652) works well. Multimode fiber has higher attenuation and is not recommended. The fiber must be in good condition with low loss and few splices. Dark fiber is preferred because it has no live traffic, but you can also use a spare wavelength on a lit fiber with proper filtering.

How deep should the fiber be buried?

For intrusion detection, shallow burial (0.3–0.6 meters) gives the best sensitivity because surface vibrations attenuate quickly with depth. Deeper burial (1–2 meters) still works for heavy digging but reduces sensitivity to footsteps. The fiber should be in direct contact with soil, not in an empty conduit.

What is the typical detection range for footsteps?

In good soil conditions, footsteps can be detected up to 5–10 meters from the fiber. Digging with a shovel can be detected at 15–20 meters. Vehicles are detectable at 30–50 meters. These ranges decrease in wet or loose soil because vibration dampens faster.

How do I handle false alarms from road traffic?

Use a combination of geofencing (ignore zones near known roads) and spectral analysis (traffic has a different frequency signature than walking or digging). Some systems also use two fibers spaced a few meters apart; traffic affects both equally, while a local intrusion affects only one, allowing cancellation.

Can DAS work through concrete or asphalt?

Yes, but sensitivity is reduced. Concrete and asphalt attenuate high-frequency vibrations more than soil. Thick concrete (over 0.3 meters) may block footsteps entirely. For detection through paved surfaces, consider installing the fiber in a shallow saw-cut channel filled with sand before repaving.

Is DAS subject to interference from other utilities?

Power lines can induce 50/60 Hz noise, which is usually filtered out. Gas pipelines do not interfere. Water mains can cause low-frequency noise from flowing water, but this is steady and can be subtracted as background. The main interference is from other vibration sources, not electromagnetic.

What is the typical lifespan of a DAS system?

The interrogator laser has a rated lifetime of 5–10 years, depending on the type. The fiber itself lasts 20+ years if undisturbed. Software updates are typically provided for the life of the interrogator. Expect to replace the interrogator after 7–10 years.

8. Practical Takeaways

Fiber-optic intrusion detection is a powerful tool, but it is not for every site. Here are your next moves if you are considering it:

1. Audit your existing fiber assets. Check if you own or lease dark fiber along the perimeters you want to monitor. Measure loss and note any slack loops or conduit paths.
2. Run a pilot with a rented interrogator. Most vendors offer short-term rentals. Deploy for two weeks, collect baseline data, and evaluate the false alarm rate in your environment.
3. Compare costs against alternative sensors. Calculate total cost of ownership over five years, including installation, maintenance, and software. DAS often wins on long linear assets but loses on small sites.
4. Plan for integration. Ensure your SOC can consume DAS alarms. Test the SNMP or API integration before committing.
5. Train your team. DAS requires a different skill set than traditional perimeter sensors. Operators need to read spectrograms and understand the system's limitations.

Finally, remember that DAS is a detection layer, not a complete solution. Combine it with cameras, lighting, and response procedures. When used correctly, it can turn your city's existing fiber backbone into a living, breathing intrusion sensor—one that never sleeps and covers miles of underground infrastructure at a fraction of the cost of dedicated alternatives.