Prerequisites
Method: Detecting deepfakes in video and audio verification.
01
Every aircraft in contested airspace broadcasts its own position
Automatic Dependent Surveillance-Broadcast transmits aircraft identity, altitude, speed and position to anyone with a receiver. That signal does not discriminate between military planners, civilian air traffic controllers and open-source investigators. The same feed that routes commercial flights is the feed you can query from a browser.
ADS-B data has placed sanctioned aircraft at undisclosed locations, tracked government jets to meetings their owners denied attending, and established the flight path of military hardware through airspace where it had no permission to be. The technique is not exotic. It requires a browser, a registration database and the discipline to document what you find before the feed overwrites it.
The investigative value sits in the gap between what an operator declares and what the aircraft actually does. A jet registered to a shell company in the Isle of Man that lands three times in six weeks at a private strip near a sanctioned individual's compound is a documented pattern. ADS-B data establishes the fact of the landings; registration lookup traces the ownership chain; flight-path analysis rules out coincidence. Each step is reproducible and each can be cited by name, date and source.
In the field
The Joint Investigation Team's 2016 public report into MH17 used open aviation records, transponder data and flight-path reconstruction to establish the route of Russian military hardware through eastern Ukraine. Tracking of the Buk missile launcher's transporter aircraft, cross-referenced with civilian ADS-B feeds and ground imagery, placed specific assets in specific locations on specific dates.
- Transponder correlation. Squawk codes and ICAO hex addresses were cross-referenced against the Russian military aviation registry to confirm aircraft identity independent of stated call signs.
- Flight-path reconstruction. Archived ADS-B feeds and radar data were assembled into a continuous movement timeline, establishing departure points, transit corridors and landing locations.
- Registry ownership trace. Aircraft registration databases linked tail numbers to operating units, confirming the military chain of custody for assets present in the conflict zone.
Joint Investigation Team · MH17 investigation · 2014–2016
Learning outcomes
By the end of this tutorial you will be able to:
Identify an aircraft by ICAO hex address, tail number and squawk code and explain the relationship between the three identifiers
Query live and archived ADS-B feeds to retrieve position, altitude and flight-path data for a specific aircraft
Trace aircraft ownership from a tail number through national and international registration databases to an operator or beneficial owner
Detect transponder manipulation indicators and assess when an absence of ADS-B data is itself investigatively significant
Document a complete flight record to chain-of-custody standard using screenshots, archive captures and source citations
This tutorial is for Signal subscribers.
Methods goes deep on a single technique each fortnight. The decision framework, the tools, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library
- Methods, all tradecraft tutorials in full
- Shadow Analysis, all evidence-based reporting
- Forensic Dossiers, full access
- Discord access included
