Aircraft: Data Point Intelligence Guide

An aircraft carries three identities at once: what is painted on the tail, what the transponder broadcasts, and who actually owns it. They rarely agree.

Understanding the Aircraft as an intelligence artifact

An aircraft is identified by its registration mark, allocated by the state of registry, and by a twenty-four-bit ICAO address expressed as six hexadecimal characters and broadcast continuously by the Mode S transponder and ADS-B. Blocks of hexadecimal addresses are allocated to countries, so the prefix indicates the state of registry. Additional identifiers include the manufacturer serial number, which is fixed to the airframe for life, the selective calling code, and operator callsigns which change on every flight.

Registration marks are reassigned when an aircraft moves to a new register, and the hexadecimal address changes with it, but the manufacturer serial number does not. Ownership is commonly held through trusts, leasing companies and special purpose vehicles in registry-friendly jurisdictions. Broadcast data carries position, altitude, velocity and callsign, though some operators enrol in privacy programmes, use temporary identifiers, or simply switch the transponder off for a leg.

Why it matters

Aircraft movements are high-signal because they are expensive, deliberate and largely public. Tracking an airframe yields a dated pattern of destinations connecting people, organisations and jurisdictions with unusual reliability. Registration and serial number give a documentary chain through registers, leases, airworthiness records and export approvals. For sanctions work aircraft are directly designated, and their movements are among the most visible and datable indicators of evasion available.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

The hexadecimal prefix identifies the state of registry, which may differ sharply from the operator's real base.
Repeated route pairs and ground dwell times establish an operating pattern and the airfields a subject actually uses.
Flights into airfields with no scheduled service indicate special-purpose operations that require an explanation.
Registration changes without a change of manufacturer serial number reveal reflagging of the very same airframe.
Transponder-off legs bracketed by known departures and arrivals expose deliberate concealment of a movement.
Callsign conventions link an airframe to a specific operator, charter broker or government department.
Maintenance stops at particular facilities identify the technical support network sustaining the aircraft.
Ownership through trustee structures in leasing jurisdictions signals deliberate separation from the beneficial user.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

FAA Aircraft Registry — Free US registration records with owner, address, serial number and airworthiness history.
UK CAA G-INFO and EASA national registers — Registration, owner and operator details for European-registered aircraft.
OpenSky Network — Free research-oriented ADS-B history with raw message access and long-running archives.
ADS-B Exchange — Unfiltered broadcast feed including aircraft excluded from commercial privacy programmes.
ICAO 24-bit address allocation tables — Mapping of hexadecimal address ranges to the states of registry that issued them.
Planespotters.net — Community fleet and airframe histories with serial numbers, prior registrations and photographs.
Aviation Safety Network — Incident, accident and write-off records tied to specific airframes and operators.
OFAC and EU designation lists — Aircraft designated by tail number and manufacturer serial number with associated owners.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Fix the airframe — Resolve tail number and hexadecimal address to a manufacturer serial number, the only identifier surviving re-registration.
Pull the registry record — Retrieve registered owner, operator, address and registration dates directly from the state of registry.
Unwind the ownership — Trace trustees, leasing companies and special purpose vehicles through company registries toward the beneficial user.
Assemble movement history — Collect broadcast history across providers, note coverage gaps, and build a destination and dwell-time profile.
Corroborate ground presence — Check imagery, airport photography and published notices for the airframe at claimed locations and dates.
Screen the structure — Run the aircraft, owners, operators and lessors against sanctions and export-control designation lists.
Version the evidence — Archive registry entries and track extracts with retrieval dates, since registers are updated without retaining history.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Geospatial Intelligence — Intelligence Derived from Place
Technical Intelligence — Technology Capability, Design, and Exploitation
Logistics Intelligence — Cargo, Freight, and Physical Movement
Sanctions Intelligence — Screening, Designations, and Evasion Detection
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Aviation Intelligence — Aircraft, Flights, and the Aviation Domain

Investigated in these domains

Pivots to these data points

Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.

Inside the platform: where Aircraft lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

domain.php?d=aviation — Aircraft profile
datapoint.php?dp=dp_aircraft — Data point hub
domain.php?d=weapons — Weapons Trafficking dashboard
domain.php?d=mil — Military & Defense dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Fix the airframe is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Unwind the ownership turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Version the evidence feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Aircraft

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Aircraft tracking supports air picture maintenance, indications and warning, force protection and monitoring of adversary and third-party air movements including resupply and personnel transfers. Registration and hexadecimal address resolve an airframe to a state of registry and an operator, and dwell patterns at particular airfields characterise a logistics network. Analysts also use it defensively, since an organisation's own aircraft and those of partners are visible to everyone else, which is an operational security finding in its own right. Constraints include the limits of receiver coverage, the fact that a callsign is chosen per flight, and the absence of any passenger information, which makes attribution to individuals speculative.

🕵 National intelligence

Air movements are expensive, deliberate and largely public, which makes them unusually high-signal against requirements on sanctions evasion, arms transfers, rendition and elite travel. The airframe serial number is the identifier that survives re-registration, so it anchors long-running collection across flag changes. Fusion with registry, leasing and corporate records exposes the trust and special purpose vehicle structures typical of aviation finance. Because the broadcast data is open and archived by research networks, findings are frequently releasable, and open reconstruction of a movement pattern often supports a partner request more effectively than the classified reporting it corroborates.

👮 Law enforcement

Investigators use aircraft data in trafficking, smuggling, fugitive and asset cases. Registry records are official documents naming owners and addresses, and airworthiness and maintenance records are obtainable from the authority or the operator by production order. Broadcast history from research networks is admissible with provenance, but an analyst must explain receiver coverage, the self-declared callsign and the possibility of privacy programme filtering. Passenger identity is not in the data and requires records from the operator, the handling agent or border control under legal process. Flight plans held by air navigation service providers likewise require a lawful request.

🔍 Private investigation and corporate security

Corporate security and private investigators use aircraft data for asset verification, litigation support, insurance and finance due diligence, and sanctions screening on lessors and operators. It is entirely lawful from public registers and open broadcast archives. What a private actor may not do is infer and publish the movements of a named private individual without a lawful basis, which engages privacy law and can create physical risk, nor obtain passenger manifests, flight plans or handling records by pretext. Institutional attribution to an operator or owner is defensible; personal attribution to a passenger generally is not.

📰 Journalism and OSINT media

Aircraft tracking has produced strong accountability reporting on rendition, arms flights, sanctioned oligarch travel and government use of private jets. The standards are to anchor on the airframe serial number, corroborate registry data across sources, and treat broadcast gaps as coverage until shown otherwise. Attribution of a movement to a named individual requires evidence beyond the aircraft, such as photographs, event records or statements, since the data contains no passenger information. Weigh privacy and safety before publishing movements of private individuals, and give operators and owners a right of reply on specific flights rather than on a general characterisation.

🌍 NGO, humanitarian and human rights

Human-rights organisations have used flight tracking to document rendition circuits, deportation flights, arms deliveries and sanctions circumvention. It allows documentation without any presence in a hostile environment. Care is needed on attribution: an aircraft's movement establishes the airframe was there, not who was aboard or what was carried, and human-rights findings built on inference alone are vulnerable. Where the work concerns deportations or detention transfers, victim-centred practice means protecting the identities of those aboard rather than publishing them. Preserve registry and track extracts with timestamps, since registers overwrite and aggregators revise.

🎓 University and research

Aviation research uses broadcast archives for emissions estimation, air traffic modelling, network analysis and conflict logistics studies. The OpenSky Network exists specifically to support reproducible research and provides raw message access and long archives, which is preferable to commercial feeds that cannot be redistributed. Methodological caveats are receiver coverage bias toward populated regions, filtering of blocked registrations in some feeds, and callsign instability. Where research touches identifiable individuals, ethics approval is required, and most boards will restrict publication of person-linked movement data. Deposit query parameters and derived datasets, and cite the network as required by its terms.

Playbook: working Aircraft end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Fix the airframe

Resolve the tail number and hexadecimal address to a manufacturer serial number, which is the only identifier that survives re-registration. Record the current registration, the hexadecimal address and the type and variant. A good output is an airframe record keyed on serial number with registration as a dated attribute. Stop when you can follow the aircraft across a change of register without losing it.

Phase 2 — Pull the registry record

Retrieve registered owner, operator, address, registration and de-registration dates, airworthiness status and any mortgage or lease notation directly from the state of registry. Capture it with a retrieval date because registers overwrite rather than version. A good output is a registry extract with all named parties and dates. Stop when the current registration position is documented from the authority itself.

Phase 3 — Reconstruct the registration history

Compile prior registrations, prior hexadecimal addresses and prior operators from fleet history sources and archived registry data, anchored to the serial number. Re-registration without a change of serial is reflagging of the same airframe, which is often the point. A good output is a dated registration timeline. Stop when the history reaches build or the earliest period relevant to the question.

Phase 4 — Unwind the ownership

Trace trustees, leasing companies, special purpose vehicles and finance structures through company registries toward the beneficial user, noting that trustee ownership is standard aviation finance practice rather than evidence of concealment by itself. A good output is an ownership diagram with jurisdictions and registry references. Stop when you reach an operating company, a natural person or a documented dead end.

Phase 5 — Assemble movement history

Collect broadcast history from more than one network, recording coverage characteristics and any filtering the provider applies. Build a destination list, dwell times and route pairs rather than a raw position dump. A good output is a flight list with departure and arrival airfields, times and gaps noted. Stop when the period of interest is covered or its gaps are attributed to coverage or filtering.

Phase 6 — Characterise the operating pattern

Identify repeated route pairs, ground dwell, base airfields, maintenance stops and flights into airfields with no scheduled service. The pattern is the intelligence; individual flights rarely are. A good output is a pattern description with supporting flight counts. Stop when the pattern is stable enough that additional flights confirm rather than change it. Compare the pattern against normal traffic at those airfields, so that unusual means unusual for that place rather than unusual to you.

Phase 7 — Investigate gaps deliberately

Where transponder-off legs are bracketed by known departures and arrivals, document the bracket and check whether coverage in that region would have been expected. Oceanic and low-density regions have genuine coverage gaps that are not concealment. A good output distinguishes coverage gaps from apparent deliberate silence, with reasons. Stop when each significant gap is characterised rather than assumed. Check whether other aircraft on the same route were received in the same period, which settles the coverage question quickly.

Phase 8 — Corroborate ground presence

Check satellite imagery of apron and hardstand at claimed locations and dates, airport spotter photography, notices to airmen, handling agent references and local reporting. Photographs are unusually effective for aviation because enthusiasts photograph and date airframes systematically. A good output pairs key movements with independent confirmation. Stop when the movements central to the finding have a second source. Record the photographer, date and platform for any image relied on, since these sources are frequently deleted.

Phase 9 — Screen the structure

Run the aircraft by registration and serial number, plus owners, operators, lessors and trustees, against sanctions and export-control designation lists with dated versions. Aircraft are directly designated in several programmes. A good output is a screening log covering every entity and identifier. Stop when nothing in the ownership diagram remains unscreened. Screen by serial number as well as registration, because designations increasingly attach to the airframe rather than the mark. Record the list version and date for every check.

Phase 10 — Test attribution carefully

Distinguish what the data supports, that a specific airframe operated between specific airfields at specific times, from what it does not, namely who was aboard or what was carried. Where personal attribution is asserted, require independent evidence such as photographs, event attendance or official statements. A good output states attribution level explicitly. Stop before inference about passengers enters the product as fact.

Phase 11 — Assess privacy and safety

Before publishing movements associated with identifiable individuals, apply a necessity and proportionality test and consider physical risk. Prefer institutional attribution, delay publication where a live movement could endanger someone, and record the decision. A good output is a release note documenting the assessment. Stop when the published detail is the minimum that supports the finding. Where the subject is a public official acting officially the balance shifts, but the assessment should still be written down.

Phase 12 — Archive with retrieval context

Preserve registry extracts, fleet history pages and track exports with retrieval dates, provider and coverage caveats. Registers do not retain history and aggregators revise, so the archive is the only durable record. A good output is a package supporting every claim without a live lookup. Stop when the product could be defended if every source went offline. Note which provider filtered which registrations, since that determines what your archive can and cannot show.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
FAA aircraft registry	Open	United States registration records with registered owner, address, manufacturer serial number, type, airworthiness status and registration history.	Primary documentary source for United States registered aircraft including downloadable full registry files.
UK CAA G-INFO	Open	United Kingdom register of civil aircraft with registration, type, serial number, registered owner and dates.	Documentary source for United Kingdom registered airframes and for confirming ownership changes with dates.
EASA and national European registers	Open	European aviation safety and national authority registers of aircraft, operators and airworthiness certification.	Establishes registration and certification status for European airframes and identifies the certifying authority.
OpenSky Network	Registration	Research-oriented broadcast data network providing raw message access, long historical archives and APIs for academic and non-commercial use.	The reproducible archive of choice for movement reconstruction, with terms that support publication and replication.
ADS-B Exchange	Registration	Community broadcast aggregator that does not filter aircraft enrolled in privacy programmes, with historical query access.	Captures movements that filtered commercial feeds omit, which matters for private and government aircraft.
ICAO 24-bit address allocation	Open	International Civil Aviation Organization allocation of hexadecimal address blocks to states of registry.	Determines the state of registry directly from a broadcast address, independent of any registration lookup.
Planespotters.net	Open	Community-maintained fleet and airframe histories with serial numbers, prior registrations, operators and dated photographs.	Reconstructs registration history anchored to serial number and supplies photographic corroboration of presence.
Aviation Safety Network	Open	Database of accidents, incidents, hull losses and write-offs tied to specific airframes, operators and dates.	Confirms whether an airframe still exists and surfaces incidents that explain gaps or changes in operation.
Flightradar24 and FlightAware	Registration	Commercial tracking platforms with extensive receiver networks, satellite coverage, historical playback and airport activity data.	Broad coverage and convenient history, subject to filtering of some registrations and licence limits on redistribution.
OFAC and EU designation lists	Open	Aircraft designated by tail number and manufacturer serial number alongside their owners, operators and lessors.	Establishes whether the airframe or its ownership chain is subject to a binding restriction, including export controls.
Cape Town Convention International Registry	Registration	International registry of interests in aircraft objects recording security interests, leases and assignments.	Reveals finance and leasing interests over an airframe that national registers may not disclose.
Eurocontrol and airport statistics	Open	Aggregate air traffic statistics, airport movement data and network operations reporting for European airspace.	Places an individual movement pattern in the context of normal traffic at the airfields concerned.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Aircraft. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

OpenSky API and traffic library — Retrieves and processes historical broadcast data reproducibly in Python; coverage is receiver-dependent and sparse over oceans and low-density regions.
dump1090 and local receivers — Captures broadcast messages directly for independent verification; range is line of sight, so a single receiver covers only a local area.
Registry bulk downloads — The full United States registry file enables offline matching and change detection between releases; other states publish far less consistently.
Hex address decoders — Map a 24-bit address to a state of registry from allocation tables; addresses change on re-registration, so historical mapping needs dated tables.
QGIS or Kepler for track visualisation — Plots routes, dwell and airfield use over base maps; interpolation between position reports can imply flight paths that were never flown.
Company registry and graph tooling — Unwinds trustee and special purpose vehicle structures around an airframe; trustee arrangements are standard practice and must not be read as concealment alone.
Archiving and screenshot tooling — Preserves registry pages and track extracts with retrieval dates; registers overwrite without versioning so capture timing determines what is recoverable.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

The manufacturer serial number is the spine, not the tail number. Registration marks and hexadecimal addresses both change on re-registration, so an aircraft that appears to vanish has usually just moved register with the same airframe underneath.
Coverage explains most gaps. Receiver networks are dense over Europe and North America and thin elsewhere, and oceanic legs are frequently unreceived entirely. Establish expected coverage before treating silence as a deliberate transponder shutdown.
Callsigns are chosen per flight and are weak identity evidence alone, but their conventions are informative: a consistent operator prefix or a government block links an airframe to an organisation more reliably than to any specific flight.
Trustee and special purpose vehicle ownership is normal aviation finance, not concealment. The finding is when the structure is combined with unusual routing, sanctioned counterparties or a mismatch between registered base and actual operating pattern.
Enthusiast photography is an underrated corroboration source. Airframes are photographed and dated systematically at airports worldwide, which frequently settles presence questions that broadcast data leaves ambiguous.
Passenger identity is not in the data at any level. Inferring who was aboard from an aircraft's owner or destination is speculation, and publishing it as fact is the failure mode that has damaged otherwise strong aviation investigations.
Filtered feeds differ from unfiltered ones. Some commercial providers honour privacy programmes and omit aircraft entirely, so a single-source absence establishes nothing about whether a flight occurred.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Aircraft is producing anything, and they are worth baselining before you change process or tooling.

Proportion of aircraft records keyed on manufacturer serial number rather than on registration mark alone.
Share of movement gaps characterised as coverage or filtering with supporting reasoning, rather than left as unexplained.
Rate at which key movements are corroborated by imagery, photography or documentary evidence beyond broadcast data.
Proportion of ownership chains traced through trustee and leasing structures to an operating entity or beneficial user.
Number of published findings using institutional rather than personal attribution where the evidence supported only the former.
Median time from an aircraft designation to reassessment of the associated fleet, lessors and operators.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Broadcast coverage is receiver-dependent, so gaps over oceans and low-density regions are normal rather than suspicious.
Registration marks are reassigned after de-registration, so historical records may describe a completely different airframe.
Trustee ownership is standard practice in aviation finance and is not by itself evidence of concealment or wrongdoing.
Callsigns are chosen per flight by the operator, making them weak identity evidence when used on their own.
Passenger identity is absent from the data, so inferring who was aboard a movement is speculation rather than analysis.
Some feeds filter blocked registrations, so a single-source absence of a flight proves nothing at all.

Legal and ethical considerations

Flight data is broadcast unencrypted and collecting it is generally lawful, but inferring and publishing the movements of identifiable individuals engages privacy law and can create physical risk, particularly for private aircraft. Apply a necessity and proportionality test before attributing a movement to a person, and prefer institutional attribution where possible. Respect provider terms on bulk access and redistribution. Preserve registry and track extracts with timestamps, because registers overwrite rather than version their records.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Aircraft, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 3 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

The aircraft disappears from tracking over the ocean. Is that suspicious?

Almost never. Broadcast reception depends on ground receivers within line of sight, and coverage over oceans, deserts and sparsely populated regions is thin or absent unless the provider has satellite reception. Aircraft also broadcast at altitudes and in regions where the nearest receiver is hundreds of kilometres away. Establish what coverage exists on that route by checking whether other aircraft on the same track were received in the same period. Genuine concealment looks different: transponder-off legs in well covered airspace, bracketed by known departure and arrival, or an aircraft appearing at a destination it had no tracked route to.

How do I follow an aircraft after it changes registration?

Use the manufacturer serial number, which is fixed to the airframe for life. Registration marks are reassigned and hexadecimal addresses change with the register, so both break continuity. Fleet history sources maintained by enthusiast communities track serial numbers across registrations reliably, and registry records usually include the serial. Once you have it, search each candidate register for that serial, check the Cape Town international registry for finance interests that persist across changes, and use dated photographs to confirm the physical airframe. Then rebuild the movement history under each registration and stitch it together.

Can I say a named person flew on this aircraft?

Not from the tracking data, which contains no passenger information at all. What you can say is that an airframe associated with a named owner or operator flew between specific airfields at specific times. To attribute a passenger you need independent evidence: photographs at the airport, event attendance records, official statements, published schedules, or in an investigation the operator's or handling agent's records obtained by legal process. Publishing an inference about who was aboard is both factually unsupported and, where the person is private, a serious privacy and safety problem. Report what the airframe did and source the passenger claim separately.

What is the difference between OpenSky and the commercial trackers?

OpenSky is a research network with long archives, raw message access and terms designed for academic and non-commercial reproducibility, which makes it the right choice when others need to replicate your work. Commercial platforms have larger receiver networks, satellite reception and better coverage, but filter some registrations, restrict redistribution and revise history. ADS-B Exchange sits between them, aggregating community receivers without honouring privacy filters. In practice, use more than one: coverage differs, and a movement absent from one source and present in another is a data artefact rather than a finding.

Is it lawful to publish flight movements of a private aircraft?

Collecting broadcast data is generally lawful since it is transmitted unencrypted, but publishing movements that identify an individual engages privacy and data protection law in Europe and elsewhere, and can create physical risk. Some jurisdictions have introduced restrictions on real-time publication of specific aircraft. The defensible approach is to apply a necessity and proportionality test, prefer attribution to an institution or company rather than a person, avoid real-time publication of a live movement, and publish only the detail the public interest requires. Record the assessment. Where the subject is a public official acting officially, the balance shifts considerably.

What does the hexadecimal address tell me on its own?

It tells you the state of registry, because ICAO allocates blocks of 24-bit addresses to states, so the prefix maps to a country. That is genuinely useful, since it can immediately contradict an assumption about where an aircraft is based, and it works even when you cannot resolve the registration. What it does not tell you is the operator, the base of operations or the beneficial owner, all of which frequently sit in different countries from the register. Note also that the address changes when the aircraft re-registers, so historical data requires dated allocation tables rather than current ones.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ICAO Annex 7 governs aircraft nationality and registration marks and the allocation of the 24-bit aircraft address.
ICAO Annex 10 specifies the Mode S and automatic dependent surveillance broadcast transmissions that carry identity and position.
The Chicago Convention establishes the state of registry framework and the obligations attaching to registration.
The Cape Town Convention and its Aircraft Protocol govern international interests in aircraft objects and the associated registry.
EASA and FAA airworthiness regimes define the certification and maintenance records that document an airframe's life.
Sanctions regimes designating aircraft by tail number and serial number impose export-control and service prohibitions on named airframes.
The EU General Data Protection Regulation applies where movement data is used to profile identifiable individuals.
The Berkeley Protocol on Digital Open Source Investigations sets preservation and verification standards for open source flight evidence.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Aircraft registration inquiry and registry downloads — United States Federal Aviation Administration. Registration records with owner, serial number and airworthiness status.
G-INFO aircraft register — United Kingdom Civil Aviation Authority. United Kingdom civil aircraft registration and ownership records.
OpenSky Network research data — OpenSky Network. Open broadcast archive supporting reproducible flight movement research.
ADS-B Exchange unfiltered tracking — ADS-B Exchange. Community aggregation that does not filter privacy-enrolled aircraft.
Annexes to the Convention on International Civil Aviation — International Civil Aviation Organization. Standards governing registration marks, aircraft addresses and surveillance broadcasts.
Aviation Safety Network database — Flight Safety Foundation. Accident, incident and hull loss records tied to individual airframes.
International Registry of Mobile Assets — Aviareto for the International Civil Aviation Organization. Cape Town Convention registry of interests in aircraft objects.
Sanctions designations including aircraft — Office of Foreign Assets Control, US Department of the Treasury. Airframes designated by tail number and manufacturer serial number.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: links airframes to registries, beneficial owners and broadcast movement histories with gap analysis. Explore the platform, or browse the rest of the library by following any tag above.