In contemporary geopolitics, state-sponsored air mobility leaves an indelible, if intentionally obscured, electromagnetic signature across the globe. From clandestine arms deliveries to sanctioned regimes and covert diplomatic rendezvous to the logistical resupply of expeditionary forces, military transport aircraft and VIP executive jets operate within an international airspace framework governed by international radio standards.

While commercial flight tracking applications (such as Flightradar24 or FlightAware) deliberately filter, block, or obscure military and state-owned airframes at the request of sovereign defense ministries, open-source intelligence (OSINT) investigators rely on uncensored crowdsourced receiver networks.

By analyzing raw Automatic Dependent Surveillance-Broadcast (ADS-B) radio packets, understanding Multilateration (MLAT) mathematics, and mapping intentional transponder “dark zones,” researchers can reconstruct flight corridors with evidentiary certainty.

This manual outlines the technical architecture of military flight tracking, the decoding of transponder broadcast packets, and the forensic methodology required to document state air operations.

1. The Electromagnetic Foundation: ADS-B vs. Mode S

To track state aircraft without relying on filtered commercial interfaces, investigators must first understand the radio protocols broadcast by transponders in the 1090 MHz and 978 MHz bands.

                           AIRCRAFT TRANSPONDER EMISSIONS
                                        │
           ┌────────────────────────────┴────────────────────────────┐
           ▼                                                         ▼
     MODE S SQUITTER (1090 MHz)                                ADS-B OUT (DO-260B)
  • 24-bit ICAO Hex Address                                 • Satellite GNSS Coordinates
  • Pressure Altitude (100ft / 25ft)                        • Ground Speed & True Track
  • Squawk Mode 3/A Code                                    • Vertical Velocity & Heading
  • No Coordinates Included (Requires MLAT)                 • Direct Autonomous Positioning

Automatic Dependent Surveillance-Broadcast (ADS-B Out)

Under the ADS-B Out protocol (RTCA DO-260B standard), the aircraft’s onboard Flight Management System (FMS) couples internal GPS/GNSS receiver readings with barometric altimeter data and continuously broadcasts unencrypted digital messages twice per second on 1090 MHz.

Crucially, ADS-B Out broadcasts require no interrogating ground radar radar pulse. Any consumer software-defined radio (SDR)—such as an RTL-SDR dongle paired with a tuned quarter-wave antenna—can ingest and demodulate these broadcasts within line-of-sight distance (typically 200–250 nautical miles at cruising altitude).

Mode S and Multilateration (MLAT)

Older military transports (such as older-generation C-130 Hercules variants, Il-76s, or strategic bombers) frequently do not broadcast ADS-B Out coordinates. Instead, they emit standard Mode S replies.

A Mode S broadcast transmits the aircraft’s unique 24-bit ICAO hex code and altitude, but omits latitude and longitude. To position an aircraft that emits only Mode S, receiver networks deploy Time Difference of Arrival (TDOA) multilateration:

1. At least four separate ground receivers with synchronized microsecond-accurate NTP or GPS clocks record the precise instant they receive a Mode S transmission.
2. The slight nanosecond differences in reception times generate hyperbolas of constant time difference between pairs of ground stations.
3. The geometric intersection of three or more hyperbolic surfaces computes the 3D coordinates (latitude, longitude, and altitude) of the airframe, rendering non-ADS-B military flights visible.

2. The Forensic Anatomy of a 24-Bit ICAO Hex Address

Every registered airframe in civil and military service is assigned a permanent, unique 24-bit address by the International Civil Aviation Organization (ICAO), encoded as a 6-character hexadecimal string (e.g., AE05BE, 152C3B, 50801E).

HEX ADDRESS STRUCTURE:
  ┌───────────────┬───────────────────────────────┐
  │ Country Block │ Airframe Sequential Bitfield  │
  └───────────────┴───────────────────────────────┘
   [Bits 1–12]                  [Bits 13–24]

The Invariance of the Hex Code

While an aircraft’s tail registration can be painted over and its tactical callsign (e.g., RCH814, FORTE11) changed at will between flight legs, the Mode S transponder’s 24-bit ICAO address is hard-coded into the avionics unit. Unless maintenance crews manually reprogram the transponder unit, the 24-bit address remains identical across all sorties.

Military Block Allocations

ICAO allocates specific contiguous blocks of hexadecimal addresses directly to national defense ministries. Recognizing these block ranges allows investigators to instantly recognize an unlabelled target as a military asset:

• United States Armed Forces: Block AE0000 through AFFFFF (Allocated to USAF, USN, US Army, and USMC).
• United Kingdom RAF / Military: Block 43C000 through 43CFFF.
• Russian Federation State Aviation: Block 150000 through 15FFFF (including 223rd and 224th Flight Squadrons operating state cargo Il-76 and An-124 airframes).
• Iranian Air Force / Saha Air: Block 730000 through 737FFF.

3. Investigating Unfiltered Networks: ADS-B Exchange vs. The Censorship Model

When investigating state military corridors, commercial trackers (Flightradar24, FlightAware) cannot be used as primary evidentiary sources due to their contractual compliance with the FAA’s LADD (Limiting Aircraft Data Display) and BAP (Block Aircraft Program) registries. Under these programs, any private or government operator can petition to have their aircraft removed from consumer maps.

Investigators rely exclusively on uncensored community aggregators: * ADS-B Exchange (ADSBx): Ingests raw feeds from thousands of volunteer SDR receivers without filtering military, police, or private luxury aircraft. * OpenSky Network: An academic research repository archiving raw decoded Mode S packets, providing academic query access to historic flight logs and raw timestamped state vectors. * Airplanes.live & The Radar Plane Project: Distributed community mirrors serving uncensored ADS-B vector streams via open JSON APIs.

# Querying OpenSky Network REST API for real-time states of a specific military hex
curl -u "investigator_user:password" \
  "https://opensky-network.org/api/states/all?icao24=ae05be" \
  | jq '.states[] | {callsign: .[1], origin_country: .[2], longitude: .[5], latitude: .[6], altitude: .[7]}'

4. Forensic Methodology: Auditing “Transponder Dark Zones”

Military transport crews flying sensitive logistical missions (e.g., carrying munitions, covert deliveries, or crossing hostile borders) rarely keep their transponders active throughout an entire flight. Instead, they execute deliberate transponder blackouts.

Forensic documentation of a dark zone involves a four-phase triangulation methodology:

[DEPARTURE AIRFIELD] ──────► [TRANSPONDER ON] ──────► [TRANSPONDER KILL]
                                                       │
                                                       ▼ [ESTIMATED VECTOR]
                                                       │ (Speed, Altitude, Heading)
                                                       ▼
[ARRIVAL AIRFIELD]   ◄────── [TRANSPONDER ON] ◄────── [DARK ZONE TRANSIT]

Phase 1: Departure Vector Preservation

Capture the terminal transponder burst immediately before shutoff: * True Heading: The azimuth angle at the final ping. * Ground Speed & Altitude: If the aircraft is cruising at Mach 0.78 at 34,000 feet, establish the fuel-burn velocity and range radius. * Climb/Descent Rate: A negative vertical velocity before transponder cut indicates a planned approach to a regional strip.

Phase 2: Calculating Dead Reckoning Radii

Using the time elapsed between transponder loss and re-emergence: $$\text{Maximum Displacement Radius} = \Delta t \times V_{\text{ground}}$$ By drawing an elliptical range ring centered on the last known fix, investigators constrain the potential airstrips within the aircraft’s fuel and speed profile.

Phase 3: Satellite Cross-Referencing

Once the dark zone bounding box is mathematically constrained: 1. Query Sentinel-2 optical passes or PlanetScope daily 3-meter imagery over candidate airfields within the dead reckoning envelope. 2. Inspect revetments, taxiways, and military cargo aprons for matching wing geometry (e.g., 50.5m wingspan of an Il-76 or 40.4m wingspan of a C-130) within 24 hours of the flight gap. 3. Compare satellite acquisition timestamps with the transponder disappearance window to confirm physical airframe presence on the ground.

5. Identifying Illicit Airbridges: Case Signatures

When tracking covert air mobility, flights rarely operate as isolated missions; they operate as repetitive airbridges. Investigators look for three distinct operational signatures:

6. Evidentiary Standards: Preparing Judicial Aviation Dossiers

To submit flight tracking findings to international tribunals, investigative newsrooms, or human rights bodies, raw screen captures are insufficient. Investigators must compile an auditable evidentiary chain of custody:

1. Raw JSON Payload Export: Download the timestamped receiver records containing raw sensor coordinates, receiver ID hashes, and microsecond signal times.
2. Squitter Packet Dump: Preserve raw 112-bit hex Mode S packets demonstrating that the broadcast was received directly over RF and not fabricated.
3. Ephemeris & Weather Corroboration: Cross-reference flight levels with atmospheric sounding data (METAR/TAF) to confirm ground wind vector offsets.
4. Permanent Web Archive: Hash the tracker permalinks and store full HTML/JSON snapshots across distributed archival repos.

By pairing uncensored ADS-B aggregation with satellite corroboration, open-source researchers ensure that sovereign military logistics cannot operate in absolute secrecy.