The Signal

A weekly briefing on the latest OSINT tools, community leads, and essential updates from the world of digital forensics.

All Posts

Riyadh airport strikes: the timeline Saudi alerts left out

The Signal

Oct 15, 2026

Riyadh airport strikes: the timeline Saudi alerts left out

The record held enough to flag Riyadh's deadliest strike two days early. Flight playback and NOTAMs keep the airport's own clock. Interception claims now sit beside an airport that kept closing

Derek Bowler

Irkutsk plague scare: the official posts that changed

The Signal

Oct 8, 2026

Irkutsk plague scare: the official posts that changed

The open record named plague on 2 October, two days before Moscow said pneumonia. Post numbering and edit markers show when an official statement changes. Rospotrebnadzor's diagnosis now sits beside a plague protocol it has not explained

Derek Bowler

Moscow named its Kyiv telecoms targets. Routing data tests the claims

The Signal

Oct 1, 2026

Moscow named its Kyiv telecoms targets. Routing data tests the claims

Russia hit Kyivstar and Kyiv data centres through September. IODA routing and probing data times the outage, or its absence, on the named networks we could match. Moscow's military-use claims and the measured record now go on file, side by side

Derek Bowler

Rubio's American-linked tankers fly no American flag

The Signal

Sep 24, 2026

Rubio's American-linked tankers fly no American flag

Build a ship-by-ship file on the CPC tanker strikes and show which layer, if any, made each vessel American

Derek Bowler

The Signal

Sep 17, 2026

The Signal — Issue #013: Bulgaria's second arms depot fire in a month

A second EMCO depot burned in five weeks and nobody has named a cause. Free satellite data can verify a blast site independent of any official statement. EMCO calls it sabotage, Sofia calls it open, and the gap between them is the story

Derek Bowler

The Signal

Sep 10, 2026

The Signal — Issue #012: Serbia's spyware denial skips one link

Fourteen Serbian phones were confirmed infected with Pegasus and NoviSpy this week. Here is the free forensic tool Amnesty used to check one yourself. Then document the server link Serbia's denial never once addresses

Derek Bowler

The Signal

Sep 3, 2026

The Signal — Issue #011: the Kuhestak wedding strike and the 135-metre gap CENTCOM hasn't addressed

A new US strike wave hit southern Iran, and Iran struck back within hours across four countries. France 24 geolocated a contested wedding-strike site to a measured distance from its likely target. Here is the technique, and what CENTCOM's statement still hasn't addressed

Derek Bowler

The Signal

Aug 27, 2026

The Signal — Issue #010: Guatemala calls Hegseth's bluff over strikes deal

Guatemala denies the land deal Hegseth just announced, and Ecuador's paper trail shows exactly what's coming next

Derek Bowler

The Signal

Aug 20, 2026

The Signal — Issue #009: The corridor CENTCOM calls open

Intercept: the route promoted as safe absorbed sixteen of eighteen UKMTO strikes since July. Signal: reading UKMTO logs against AIS gaps flags a shifting corridor early. Shadow: CENTCOM's open-route claim and the shipping industry's own blackout behaviour disagree

Derek Bowler

The Signal

Aug 13, 2026

The Signal — Issue #008: Google's AI broke the satellite baseline

Google's Earth AI generated fake satellite imagery of nuclear sites and war damage anchored to real coordinates before being pulled within a day. Its own watermark caught some fakes and missed others. Cross-checking against independent satellite sources is now the technique every practitioner needs

Derek Bowler

The Signal

Aug 6, 2026

The Signal — Issue #007: Water utilities hacked in seven US States, attribution still unconfirmed

Federal agencies confirm PLC intrusions at water utilities in seven US states with the Iran attribution unconfirmed. Shodan and Censys show how to map the same exposure the attackers exploited. The record holds a technical pattern, a political denial, and no forensic proof

Derek Bowler

The Signal

Jul 30, 2026

The Signal — Issue #006: Testing Perenco's Congo gas flare claim

Human Rights Watch put five flaring sites on the open record this week. Perenco says 220 flare points are permanently out. Neither claim resolves without a date, and that gap is the story

Derek Bowler

The Signal

Jul 23, 2026

The Signal — Issue #005: The name DHS wouldn't confirm

ICE refused to name the agent who killed Johan Sebastián Durán Guerrero in Biddeford. A public records corroboration standard confirmed his identity within three days. The same denial has repeated across three shootings in two weeks, and this issue shows you how to document it

Derek Bowler

The Signal

Jul 16, 2026

The Signal — Issue #004: Patriot Front pays for itself

A 2022 chat leak and two federal court judgments show how Patriot Front actually funds itself

Derek Bowler

The Signal

Jul 9, 2026

The Signal — Issue #003: Iran's unclaimed tanker strikes

Iran struck three tankers off Oman's coast on a route its own broadcaster had already warned ships to avoid. A free satellite pass and a UKMTO advisory trail build the record Iran never had to claim. No formal admission survives this timeline

Derek Bowler

The Signal

Jul 2, 2026

The Signal — Issue #002: When the open record fractures

Twin earthquakes sealed Venezuela's worst-hit zone within hours. Copernicus EMS activated damage mapping the next day. The gap between official figures and the open record is documentable now, without physical access

Derek Bowler

The Signal

Jul 1, 2026

The Signal — Issue #001: The AIS heading field Iran's denial cannot survive

A drone struck the Ever Lovely on an authorised corridor and Iran denied it. The heading field in AIS data caught four coerced vessels before a weapon was fired. The open record and the official denial are in direct conflict and this issue shows you how to document it

Derek Bowler