Cleartext at the Edge: A Neptune R900 Case Study in RF Telemetry Exposure

Security teams are trained to think in terms of networks, endpoints, cloud systems, identity, and applications. But many cyber-physical systems communicate through a layer that often sits outside traditional security visibility: radio frequency.
This talk presents a passive RF case study of Neptune R900 water meter telemetry and the broader security implications of cleartext AMR communications. Using low-cost software-defined radio tooling and receive-only observation, the research examines how wireless meter telemetry can expose structured data such as meter identifiers, consumption readings, status indicators, timestamps, and signal metadata before that data ever reaches utility-controlled systems.

The presentation walks through the RF security model, the AMR data flow from meter endpoint to utility systems, and the privacy risks created when repeated cleartext telemetry becomes pattern-of-life data. It also maps the findings to a qualitative risk model focused on likelihood, impact, and cyber-physical context. The discussion includes responsible research boundaries, disclosure considerations, and recommendations for utilities, vendors, and security teams.

Attendees will leave with a practical understanding of why RF telemetry should be treated as part of the attack surface, why legacy AMR design assumptions create modern privacy and trust-boundary risks, and how procurement, threat modeling, and architecture reviews can better account for signal-layer exposure.