Prerequisites
Tutorial 16: Detecting deepfakes in video and audio verification.
01
Every powered aircraft is broadcasting its own position
Most commercial aircraft, and a growing share of private jets, continuously transmit their identity, position and altitude over an open radio standard. The signal is free to receive, and unless the owner has taken deliberate steps to suppress it, free to analyse.
Automatic Dependent Surveillance-Broadcast, or ADS-B, was built for air traffic safety, not privacy. An aircraft equipped with an ADS-B transponder broadcasts its identity, GPS position, altitude and speed roughly twice a second, on a public frequency that any suitably tuned receiver can pick up. A global network of hobbyist and commercial receivers collects this data and republishes it through flight-tracking websites, most of which are free to use.
For an investigator, that broadcast is a movement record an aircraft's owner cannot fully control. Undisclosed travel, sanctions-evasion routing, surveillance-flight patterns and the real use of a jet nominally owned by a shell company have all been documented from ADS-B data. This tutorial covers reading raw transponder data, resolving a hex code to a registered aircraft and its ownership trail, working around the redaction that wealthy or state-connected owners commonly request, and building a flight record that will hold up in publication.
In the field
Investigating the wealth of Kazakhstan’s former president Nursultan Nazarbayev, OCCRP reporters obtained a document showing his charitable foundation had received an import-duty exemption for a new Airbus ACJ320neo worth more than $100 million. The document gave only an import date and aircraft type, not a tail number or hex code.
- Document-led filtering. Reporters used the import date and aircraft type to search uncensored flight data by plane type and take-off and landing location, and found only one ACJ320neo had flown in Kazakh airspace since June 2020.
- Uncensored data source. The search ran on Icarus Flights, a C4ADS platform fed by ADS-B Exchange data, which does not honour the redaction requests that standard consumer trackers apply.
- Movement correlation. A follow-up pull from OpenSky Network surfaced further flights, including one to Moscow the same day the Kremlin announced Nazarbayev had held a working meeting with Putin, plus domestic trips matching his public appearances: compelling evidence, in OCCRP’s own framing, that the jet was used by Nazarbayev despite its formal ownership by a charity.
OCCRP · The Nazarbayev Billions: How Kazakhstan’s Leader of the Nation Controls Vast Assets Through Charitable Foundations · January 2022
Learning outcomes
By the end of this tutorial you will be able to:
Read raw ADS-B and Mode-S transponder data (hex code, callsign, position, altitude) from a public tracker
Resolve an aircraft's hex code to its registration, model and country of registration
Identify when an aircraft's tracking data has been redacted and select an uncensored data source
Cross-reference flight endpoints against a subject's claimed or reported movements to build a corroborated travel record
Document a flight history to an evidentiary standard suitable for publication
This tutorial is for Signal subscribers.
Methods goes deep on a single technique each fortnight. The decision framework, the tools, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library
- Methods, all tradecraft tutorials in full
- Shadow Analysis, all evidence-based reporting
- Forensic Dossiers, full access
- Discord access included
