There is a version of this story that Whitehall would prefer you never read. Somewhere in a Welsh valley, or on the edge of a Scottish moorland, a volunteer with a soldering iron and a Raspberry Pi is doing the job that a multi-billion-pound government infrastructure programme was supposed to do. The Emergency Services Network has been delayed so many times that it has become something of a dark joke in technical circles. Airwave, the existing TETRA-based system, still has coverage holes that could swallow a rescue team whole. And in those gaps, something genuinely interesting is happening: volunteer-run technical communities are building their own comms infrastructure, piece by piece, node by node.
I have spent time talking to the people doing this work, and what strikes me most is not the ingenuity, though there is plenty of that. It is the sheer necessity of it. This is not hobbyist radio enthusiasm for its own sake. This is LoRaWAN emergency communications UK that exists because the official answer is still years away, if it arrives at all.
The Airwave and ESN problem, in plain terms
Airwave is a TETRA-based digital radio network run by Motorola Solutions under contract to the Home Office. It costs around £550 million a year to run and was supposed to be replaced by the Emergency Services Network, which was meant to use commercial 4G LTE infrastructure managed by EE. ESN has been in various states of crisis since at least 2016. The National Audit Office has flagged it repeatedly, most recently noting that the programme has cost over £11 billion when sunk costs are included, with full operational capability still not delivered.
The practical problem in rural areas is coverage. Commercial 4G infrastructure, which ESN depends on, follows commercial logic. It goes where the subscribers are. Dartmoor, the Brecon Beacons, Sutherland, the North York Moors. These places have sparse coverage at best and genuine blackspots at worst. Retained fire crews responding to a wildfire, mountain rescue teams on a callout, ambulance crews navigating a moorland track: all of them can find themselves without a reliable radio link at the exact moment they need one most. For context on what this kind of systemic neglect does to rural emergency capability more broadly, this piece on the quiet crisis in britain’s volunteer fire services: how rural communities are being left to burn is worth reading alongside what follows.
What LoRa actually is, and why it fits this problem
LoRa stands for Long Range. It is a physical layer modulation technique developed by Semtech, and it is genuinely clever. By using chirp spread spectrum modulation across narrow bandwidths, LoRa achieves remarkable range on very low power. A single node running on a small battery can push a packet 10 to 15 kilometres across open terrain. In hilly country that number drops, but the technology tolerates adverse RF environments better than most alternatives at this price point.
LoRaWAN is the network protocol that sits on top of LoRa, defining how devices authenticate, how packets are routed, and how gateways connect to a network server. The Things Network, which has community-run gateways across the UK, operates on LoRaWAN. So does Helium, though its coverage in rural Britain is spottier than the marketing implies. The key point is that a LoRaWAN gateway costs between £80 and £300 depending on specification, runs on mains or solar, and can be mounted on a fence post. You do not need a planning application for a small antenna installation below certain height thresholds, and Ofcom licences the 868 MHz band used by LoRaWAN in the UK as licence-exempt, meaning communities can deploy without spectrum fees.
How volunteers are actually deploying this
The implementations I have seen or heard described vary quite a bit in sophistication. At the simpler end, local amateur radio clubs are placing Dragino LPS8N or RAK7268 gateways on hill farms and community buildings, stitching together coverage along valleys where Airwave drops out. The nodes feed into a self-hosted ChirpStack network server, which logs telemetry and can relay alerts via MQTT to a web dashboard that duty controllers can watch. The data rate on LoRaWAN is low, between 250 bits per second and about 11 kilobits per second depending on spreading factor, so you are not streaming audio. What you can do is send GPS coordinates, status codes, and short text alerts reliably across distances that would defeat a standard UHF handheld.
More ambitious deployments are using Meshtastic, an open-source mesh protocol that also runs on LoRa hardware, typically the LILYGO T-Beam or Heltec LoRa 32 boards. Meshtastic builds a peer-to-peer mesh where every node acts as a repeater. There is no central gateway dependency, which matters enormously in an emergency scenario where infrastructure can fail. A team of four people on a hillside, each carrying a T-Beam, forms its own self-healing mesh. Add a node on the summit and you extend range down into the valley where the incident commander is parked. The whole setup costs less than £200 in hardware and runs on 18650 lithium cells.
Some groups are going further, integrating LoRa sensor nodes with existing digital modes used in amateur radio, particularly the APRS (Automatic Packet Reporting System) network. APRS has been used by mountain rescue teams in the UK for years and has a mature UK gateway infrastructure. Bridging LoRa mesh nodes into APRS gives you a hybrid system with significantly wider reach. It is, to be direct about it, a patchwork. But it is a functional patchwork, which is more than can be said for ESN in certain grid squares.
The governance vacuum nobody wants to talk about
Here is where it gets uncomfortable. Volunteer-deployed infrastructure operating in emergency support roles sits in a genuinely grey legal and operational space. These systems are not accredited by NPCC, not integrated into control room CAD systems, and not subject to any formal resilience testing. If a Meshtastic node gives a mountain rescue team a false GPS reading because of a firmware bug, nobody is accountable in the way that Motorola Solutions is accountable for Airwave failures. The liability question has no clean answer.
Ofcom’s position is that licence-exempt bands can be used for this kind of deployment provided power limits are respected (25 milliwatts for most LoRa operation in the UK). They do not regulate what you do with the data. But the moment a volunteer network becomes load-bearing for life-safety operations, you would expect some regulatory framework to kick in. It has not. The NCSC has published guidance on operational technology security, and the relevant fire and rescue authorities have resilience planning obligations under the Civil Contingencies Act 2004, but nobody has drawn a clear line connecting those obligations to community-deployed mesh infrastructure.
This mirrors a pattern you can see across several areas of UK critical infrastructure: the gap between what statutory bodies are required to provide and what actually exists on the ground gets quietly filled by volunteers and community groups, with no formal recognition and no formal oversight. The same dynamic appears in the way amateur radio operators provide emergency comms backup at major incidents, and in the way technically literate people in rural communities have built their own broadband infrastructure rather than wait for BDUK rollout. The pattern is worth understanding because it tells you something honest about where the state actually ends and informal resilience begins.
Where this intersects with the wider security picture
A community-deployed mesh network that carries even partial emergency coordination data is an attack surface. I would be failing in my job if I did not flag that. LoRaWAN has had well-documented security issues: early implementations often had poor key management, and replay attacks against LoRaWAN join procedures have been demonstrated in academic literature. Meshtastic encrypts channel traffic using AES-128, but the default shared key is public and many deployments never change it. A motivated attacker in range of a node could inject spoofed position packets or jam the 868 MHz band entirely with cheap hardware.
This is not hypothetical. The same class of RF interference techniques that could disrupt a LoRa mesh have been used against GPS and GSM networks by state actors. For groups deploying these systems in a genuine emergency support role, the minimum sensible precautions are: change default encryption keys, document your network topology privately, and have a fallback plan that does not assume the LoRa mesh is intact. The techniques ransomware groups use to map UK critical infrastructure are exactly the kind of recon that could identify and target a poorly-secured community comms network, particularly one that has been publicised on social media by enthusiastic volunteers.
There is also a data protection angle. If your LoRaWAN nodes are logging GPS tracks of emergency responders, that data is personal data under UK GDPR. Where is it stored? Who has access? Most volunteer deployments I have heard about have given this no thought at all. It is worth thinking about before the ICO does it for you. The parallel with how public-facing APIs can leak sensitive data, something covered in depth in the piece on UK government repositories leaking credentials and internal hostnames, is not flattering to anyone.
None of this is an argument against what these communities are doing. It is an argument for doing it with your eyes open. The people deploying LoRaWAN emergency communications in rural UK are filling a real gap with real competence. They deserve better than a governance vacuum, and they deserve better than an infrastructure programme that has burned £11 billion without delivering reliable coverage to the places that need it most. Until one or both of those things changes, the soldering irons will stay lit.
Frequently Asked Questions
What is LoRaWAN and can it actually be used for emergency communications in the UK?
LoRaWAN is a low-power wide-area network protocol built on LoRa radio modulation, operating in the 868 MHz licence-exempt band in the UK. It can transmit GPS coordinates, status codes, and short text messages over distances of 10 to 15 kilometres on open terrain, making it genuinely useful for tracking and alerting in areas where Airwave or 4G coverage fails. It cannot carry voice, so it complements rather than replaces radio comms.
Is it legal to deploy LoRa or mesh radio nodes for emergency support in the UK without a licence?
Yes, for most LoRa deployments. Ofcom permits licence-exempt use of 868 MHz at up to 25 milliwatts, which covers the vast majority of LoRaWAN and Meshtastic hardware. Amateur radio operators holding a full licence have additional options in other bands. The legal grey area is not spectrum licensing but operational accountability: there is no formal framework governing volunteer networks used in life-safety roles.
What hardware do volunteer groups typically use for off-grid mesh comms?
Common choices include Dragino and RAK Wireless LoRaWAN gateways (roughly £80 to £300) running ChirpStack or The Things Stack, and Meshtastic-compatible nodes like the LILYGO T-Beam or Heltec LoRa 32 (around £25 to £50 each). Solar-powered gateway installations are practical in rural settings and the whole infrastructure for a small coverage network can be built for under £500.
How does Meshtastic differ from standard LoRaWAN for emergency use?
Meshtastic creates a peer-to-peer mesh where every device acts as a repeater, so there is no single gateway that can fail. LoRaWAN requires at least one gateway connected to a network server. For emergency scenarios where infrastructure reliability is uncertain, Meshtastic’s decentralised architecture is more resilient, though it has lower throughput and the default encryption key is publicly known and must be changed before operational deployment.
What are the main security risks of community-deployed emergency mesh networks?
The key risks are: default encryption keys left unchanged (particularly on Meshtastic), no authentication of node identity, vulnerability to replay attacks on LoRaWAN join procedures, and susceptibility to RF jamming on the 868 MHz band. There are also UK GDPR implications if nodes log GPS tracks of responders without a lawful basis and a documented data handling policy. Operational security hygiene, changing defaults and limiting network publicity, is the minimum baseline.
Leave a Reply