This is the first multi-domain exercise. Students face two concurrent events that individually look explainable but together reveal coordination. A co-orbital object begins maneuvering near constellation assets while Electronic Warfare jamming targets the primary command uplink. Students must assess each event independently, then connect them to identify a coordinated adversary campaign.

A co-orbital object maneuvers to within close proximity of constellation assets. Students must assess whether the maneuvering represents routine orbital maintenance, a commercial inspection service, or hostile intent. The proximity assessment requires evaluating relative velocity, approach geometry, and historical orbital behavior.

Coordinated jamming targets the primary uplink frequency during the scheduled command window while the co-orbital object is in proximity. Students must switch to backup frequency to restore command authority, then connect the timing of the jamming to the co-orbital positioning. The convergence of timing and targeting reveals deliberate coordination.

The critical analytical step in this exercise is connecting Event 1 (co-orbital maneuvering) with Event 2 (EW jamming). Individually, each event has a plausible innocent explanation. Together, the timing and targeting convergence reveals a coordinated campaign designed to deny command authority while placing a physical threat in proximity.

The following questions will help finalize this exercise design. We welcome any additional recommendations.

Instructors should guide students through the multi-domain analysis process, ensuring they assess each event independently before attempting correlation.

Students completing this exercise will have performed their first multi-domain threat analysis, correlating indicators across Kinetic and Electronic Warfare domains. Module 10 is the capstone: three concurrent domains (Kinetic + Cyber + EW) with a full incident response lifecycle.