Earlier quoted context omitted.
My job overlaps with microwave and millimeter wave RF engineering somewhat. R&S also has no qualms about selling high-end spectrum analysis equipment to authoritarian regimes. Probably done through middlemen. For instance, you can find the Iranian government using their equipment in Tehran to hunt down things they don't like. To be fair, there's probably less than ten manufacturers of their category of spectrum analy…
Interesting, so triangulating people forwarding "open" internet over consumer-grade microwave (like Ubiquiti or similar)? I assume they can't do much about Toosheh since it's "read only", multiplexed with legitimate TV channels on the same transponder, and uplinked from the UAE.
In the case of an FM radio, this means you can tell what station a given receiver is tuned to, if you make certain assumptions about common LO/IF frequencies. There was a company monetizing this called "Mobiltrak", but I haven't seen much about them lately.
In the satellite case, there's the IF of the LNB itself, which leaks fairly loudly out the feedhorn, but it only tells you which band they're tuned to. There's likely a second IF used in the IRD, which should be much fainter from outside, but if you could recover that, you could tell which transponder is being demodulated.
That still wouldn't tell you if the Toosheh packets are being saved, but if the program they're muxed with isn't particularly popular, it would be a strong hint.