Aviation Intelligence (AVINT): Intelligence Discipline Guide

An aircraft broadcasts its identity and position to anyone with a twenty-dollar receiver. The intelligence is not in the position; it is in the ownership chain behind the tail number.

What Aviation Intelligence is as a discipline

Aviation intelligence covers aircraft as assets and flights as behaviour. It combines registry work, which establishes who owns and operates an airframe and through what corporate structure, with movement analysis derived from cooperative broadcast surveillance such as ADS-B. Practitioners resolve aircraft across registration marks, ICAO 24-bit addresses, serial numbers and callsigns, then reconstruct operating patterns: routes flown, bases used, maintenance visits, charter behaviour and periods of unusual activity. Airworthiness, incident and operator certification records add the safety and regulatory dimension.

Sub-methods include registry and ownership tracing through trusts and leasing companies, fleet reconstruction, movement pattern-of-life analysis, airport and ground infrastructure assessment, and incident and airworthiness research. In the intelligence cycle aviation work is a high-tempo collection source that both generates leads, through unusual movements, and validates hypotheses raised elsewhere by confirming or excluding physical presence.

Why it matters

Only aviation intelligence establishes that a specific airframe was physically at a location at a time, and connects that airframe to a beneficial owner through leasing and trust structures designed to obscure exactly that. It answers which operator really controls a fleet, whether a flight profile is consistent with the declared mission, when maintenance or storage indicates capability degradation, and whether movement patterns correlate with events such as negotiations, deliveries or evacuations.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Registration records linking tail number, serial number and ICAO 24-bit address to a registered owner and its jurisdiction
Owner trust and leasing structures that separate the registered holder from the beneficial operator of an airframe
ADS-B derived tracks giving routes, altitudes, speeds and airports used, with timestamps sufficient for presence proof
Callsign and flight number patterns revealing operator identity, charter versus scheduled use, and state or military affiliation
Repeated visits to maintenance, repair and overhaul facilities indicating heavy checks, modification or conversion work
Transponder gaps, position broadcast disabled periods and blocked registration requests indicating deliberate opacity
Airworthiness directives, incident and accident records establishing airframe history, condition and prior operators
Airport infrastructure change, including new apron, hangar and runway work, that signals capacity or basing shifts

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

OpenSky Network — Free research-oriented ADS-B archive and API with historical state vectors, ideal for reproducible movement analysis
ADS-B Exchange — Unfiltered community ADS-B feed that does not honour blocking requests, valuable for aircraft absent from filtered services
FAA Aircraft Registry — Free downloadable US registration database with owner, address, serial number and airworthiness records
EASA and national civil aviation authority registers — European and other national registration data, operator certificates and airworthiness information
Aviation Safety Network — Free searchable accident and incident database with airframe histories and operator context
Planespotters.net — Community-maintained fleet and airframe histories tracking registration changes, lessors and operator transitions
ICAO public documentation and aeronautical information publications — Standards, state letters and national AIPs describing airspace, airport capability and operating procedures
OpenCorporates and national registries — Resolves owning trusts and leasing entities on the registration record to their controlling companies and officers

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Anchor the airframe identity — Resolve the aircraft to a serial number and ICAO 24-bit address, not just a tail number, since registrations change and are reissued.
Trace the ownership chain — Follow the registered owner through trusts, lessors and holding companies in corporate registries to reach the beneficial operator.
Reconstruct movement history — Pull historical ADS-B state vectors across multiple providers, reconciling coverage gaps rather than assuming absence means the aircraft was grounded.
Establish pattern of life — Identify home base, routine sectors, typical timings and passenger or cargo profile so that anomalies become detectable.
Investigate anomalies — Examine unusual destinations, transponder gaps, holding patterns and out-of-cycle maintenance visits against corporate and event chronologies.
Corroborate on the ground — Confirm presence with satellite imagery, airport records, photography and open reporting before asserting an aircraft was at a location.
Document to evidentiary standard — Preserve raw track data with source, timestamps and receiver coverage caveats so the finding survives challenge.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
Radio Callsign — A licensed radio identifier for a station, vessel, aircraft, or operator.
Aircraft — An aircraft identified by tail number, ICAO hex, or registration.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.

Related disciplines

Logistics Intelligence — Cargo, Freight, and Physical Movement
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Supply Chain Intelligence — Supplier Networks, Dependencies, and Integrity
Vehicle Intelligence — Vehicles, Registration, and Movement

Inside the platform: where Aviation Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=AVINT — Discipline hub
source-catalog.php?disc=AVINT — Source catalogue filtered to this discipline
domain.php?d=aviation — Aircraft profile
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Score Country Risk
Sync Intel Domains
Resolve Everything
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Anchor the airframe identity is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Reconstruct movement history turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Document to evidentiary standard feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Aviation Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Aviation intelligence supports air picture compilation, force protection and pattern of life around airfields of interest. Analysts use cooperative broadcast surveillance to establish routine traffic, detect changes in tempo, identify state and contracted airlift supporting an adversary, and confirm or exclude the presence of specific airframes at specific times. Products feed J2 air reporting, airfield assessments and indications and warning on movement of high-value assets. Constraints matter: many state aircraft do not broadcast, coverage over water and denied areas is thin, and publishing detailed tracking of friendly military movements creates an operations security problem for your own side.

🕵 National intelligence

National intelligence uses aviation data for sanctions monitoring, proliferation-related cargo movement, rendition and transfer investigation, and elite mobility analysis. The high-value work is ownership tracing: connecting an airframe through trusts, leasing companies and special purpose vehicles to the person or state entity that actually controls it. Because the movement layer is open, findings can be shared and published, which makes aviation intelligence unusually effective for designations and diplomatic demarche. Fusion with corporate registries, sanctions lists and imagery converts a track into an attributable event, and coverage gaps must be stated rather than treated as absence.

👮 Law enforcement

Law enforcement uses aviation intelligence in smuggling, trafficking, sanctions evasion and asset recovery investigations. Movement histories place an aircraft, and often its known passengers, at an airport at a time, which corroborates or refutes accounts. Evidentially, aggregated track data needs to be obtained with provenance and receiver coverage caveats, and definitive records come from the aviation authority, the airport, the handling agent or the operator under production order. Registry data is public but reuse for decisions about individuals engages data protection duties, and tracking a named individual's private travel requires a legitimate purpose and proportionality assessment.

🔍 Private investigation and corporate security

Corporate and litigation teams use aviation intelligence for asset location in enforcement of judgments, due diligence on counterparties operating aircraft, insurance and lease disputes, and verification of executive travel claims. Registry and airworthiness records establish ownership, encumbrances and maintenance history. The legal boundary is purpose and proportionality: tracking an identifiable individual's movements can constitute harassment or unlawful monitoring in several jurisdictions, and some states restrict publication of certain aircraft movements. Redistribution of aggregator data is governed by contract, so check terms before including tracks in a client deliverable.

📰 Journalism and OSINT media

Aviation tracking is a mainstay of open-source journalism because it produces dated, checkable movement evidence. Verification standards require confirming the airframe identity through its permanent address rather than a registration mark, reconciling coverage gaps rather than treating them as landings, and corroborating presence with imagery, photography or airport records before publication. Give the operator a right of reply. Ethical judgement is needed around private individuals, minors and asylum-related flights, and around publishing movements in near real time when doing so could endanger people on board or on the ground.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian organisations use aviation data to document deportation and rendition flights, arms deliveries, and access constraints for relief operations. Documentation should preserve raw track data with source and time, since these findings are frequently contested. Victim-centred practice means protecting the identity of deportees and asylum seekers even when flight records make identification possible. Do no harm includes weighing whether publishing a specific humanitarian air route exposes it to interference. Duty of care applies to local monitors near airfields, who face real risk from photographing military and state aircraft.

🎓 University and research

Researchers use open aircraft surveillance data for air traffic management, emissions modelling, network analysis and surveillance system research. Methodological care centres on receiver coverage bias, which is severe over oceans, at low altitude and in poorly served regions, and on the difference between raw messages and cleaned trajectories. Ethics review applies where individuals are identifiable through private aircraft movements. Reproducibility requires citing the dataset version, the extraction window and the coverage model, and archiving derived trajectories where licensing permits rather than redistributing raw provider data.

Playbook: working Aviation Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Anchor the airframe identity

Resolve the aircraft to its manufacturer serial number and its permanent ICAO 24-bit address, not just a registration mark. Registrations are reassigned, changed on sale and used deliberately to break tracking continuity, while the serial number follows the airframe for life. A good output is an identity record listing serial number, address, current and historical registrations with dates, and type and variant. Stop when the serial number is confirmed from an authoritative registry or manufacturer record rather than inferred from a tracking site.

Phase 2 — Reconstruct the registration history

Build the sequence of registration marks, registries and effective dates. Movement between registries, particularly to jurisdictions offering trust-based registration, frequently marks a change in real control and is often the most informative single event in the aircraft's history. A good output is a dated registry timeline with the source document for each change. Stop when the chain is continuous or a gap is explicitly documented, because gaps are where the interesting transfers hide.

Phase 3 — Trace the ownership chain

Follow the registered owner through trustees, lessors, special purpose vehicles and holding companies in corporate registries until you reach a beneficial owner or an unresolvable point. Owner trustee arrangements are lawful and common, so treat them as a structure to work through rather than as evidence of wrongdoing. A good output is an ownership diagram with registry identifiers and dates. Stop when you reach a natural person, a state entity, or a documented dead end that you report as such.

Phase 4 — Establish the operator, not just the owner

Determine who actually operates the aircraft: the air operator certificate holder, the management company, the charter broker. Ownership and operation frequently diverge, and operational control is what matters for responsibility. A good output names the operator with evidence from certification records, callsign usage and handling arrangements. Stop when operator and owner are separately documented, since conflating them is the most common error in published aviation investigations.

Phase 5 — Pull movement history across providers

Retrieve historical position data from more than one source, because receiver networks have different geographic coverage and retention. Record the provider, the query and the retrieval time. A good output is a consolidated track history with the source of each segment marked. Stop when the providers agree on the segments they both cover, and investigate rather than average any segment where they disagree materially.

Phase 6 — Model coverage before interpreting gaps

Establish where the receiver network can and cannot see before concluding anything from an absence of data. Gaps over oceans, at low altitude, in mountainous terrain and in regions with few receivers are normal and constant. A good output annotates every gap with whether coverage existed there. Stop before treating a gap as a deliberate transponder shutdown unless coverage is demonstrably good in that area and time.

Phase 7 — Build the pattern of life

Identify home base, maintenance base, routine sectors, typical departure times, seasonal patterns and usual crew or handler arrangements. Anomalies only exist against this baseline, and most aircraft are extremely routine. A good output is a baseline description covering at least a year where data allows. Stop when the baseline is stable enough that a deviation is visibly a deviation rather than a data artefact.

Phase 8 — Investigate anomalies systematically

Examine unusual destinations, out-of-pattern timing, unexplained coverage-independent gaps, holding or loitering patterns, unscheduled maintenance visits and changes of callsign convention. Test each against corporate events, political events, sanctions actions and known deliveries. A good output pairs each anomaly with candidate explanations and the evidence for each. Stop before asserting a purpose for a flight from the destination alone, which is how misreporting starts.

Phase 9 — Corroborate presence on the ground

Confirm that the aircraft was where the track suggests using satellite imagery of the apron, spotter photography with timestamps, airport movement records, notices to airmen and open reporting. Presence evidence is what converts a track into a fact. A good output cites at least one independent confirmation for any consequential presence claim. Stop when corroboration is obtained or the claim is explicitly downgraded to track-only evidence.

Phase 10 — Check airworthiness, incident and certification records

Review airworthiness certificates, registration status, accident and incident records, and operator certification. Lapsed certificates, unresolved airworthiness directives and repeated incidents indicate a marginal operation, which is characteristic of aircraft used in grey market logistics. A good output summarises regulatory standing with sources. Stop when the standing of the airframe and the operator are both documented, since a compliant aircraft with a delinquent operator is a common pattern.

Phase 11 — Screen against sanctions and enforcement records

Check the airframe, registration, serial number, owners, operators and known associated persons against sanctions lists, denied party lists, export control actions and enforcement announcements. Aircraft are frequently designated by tail number and serial number specifically because of registration changes. A good output is a screening record with list versions and dates. Stop when all identified parties across the ownership chain have been screened, not just the registered owner.

Phase 12 — Document to evidentiary standard and publish carefully

Preserve raw position data with source, timestamps, coverage caveats and retrieval details, and record all registry documents with their retrieval dates because registries change silently. State clearly what is track evidence, what is registry evidence and what is inference. A good output survives a legal challenge from a well-resourced owner. Stop before publishing near real time tracking of individuals or of flights where publication could plausibly endanger those aboard.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
OpenSky Network	Registration	Research-oriented crowd-sourced aircraft surveillance archive with raw messages, state vectors and long historical retention	Historical track reconstruction with access to underlying message data rather than a rendered map
ADS-B Exchange	Registration	Unfiltered crowd-sourced aircraft tracking including aircraft other services block, with historical access options	Coverage of aircraft removed from filtered commercial feeds, which is where investigative interest usually sits
FAA aircraft registry	Open	US civil aircraft registration records with owner, address, serial number, type, registration history and downloadable database	Authoritative US ownership and serial number resolution, including trustee-registered aircraft and full registration history
EASA and national civil aviation authority registers	Open	European and national aircraft registers with registration, owner, operator and airworthiness data, varying by state	Ownership and airworthiness confirmation outside the United States, and detection of registry changes
UK Civil Aviation Authority G-INFO register	Open	UK aircraft register with registered owner, operator, serial number, type and certificate status	UK-registered airframe resolution, ownership confirmation and certificate validity checking against the official national register
Aviation Safety Network	Open	Database of accidents, incidents and hull losses with narratives, dates, operators and airframe identifiers	Airframe history and operator safety record, and confirmation that a specific hull still exists
Planespotters.net	Open	Community-maintained fleet and airframe histories with registration changes, operators, delivery dates and photographs	Fast reconstruction of an airframe's operator and registration history before confirming against registries
JetPhotos and spotter photography archives	Open	Dated and located photographs of specific airframes contributed by aviation photographers worldwide	Independent visual confirmation that an airframe was at an airport on a date
ICAO documentation and aeronautical information publications	Open	International standards, aircraft addressing schemes, airport codes and state aeronautical information publications	Reference for aircraft addressing, callsign conventions, airport identifiers and published airfield infrastructure detail
Eurocontrol network operations data	Open	European air traffic flow statistics, delay data, network reports and traffic forecasts	Baselines for traffic volume changes at European airports and route usage patterns
US Bureau of Transportation Statistics air carrier data	Open	Scheduled and non-scheduled carrier segment, market and on-time data including aircraft type and airport pairs	Commercial route and capacity baselines for judging whether an operator's activity is unusual
NTSB accident investigation records	Open	US accident and incident investigation dockets with factual reports, maintenance history and probable cause findings	Detailed airframe and operator history, often containing ownership and maintenance detail unavailable elsewhere
OpenCorporates and national company registries	Registration	Company records covering officers, addresses, filings and status across many jurisdictions	Resolves owner trustees, lessors and special purpose vehicles to their controlling entities
OFAC and EU consolidated sanctions lists	Open	Designated persons and entities including aircraft entries identified by tail number, serial number and operator	Screening the whole ownership and operating chain, which is where designations usually bite
Flightradar24 and FlightAware	Registration	Commercial tracking platforms with global receiver networks, historical playback and airport activity views	Corroboration across an independent receiver network and convenient historical review, subject to filtering
Airport and handling agent public schedules	Open	Published movement boards, slot allocations and general aviation handling information at individual airports	Ground truth for arrivals and departures where surveillance coverage is poor or aircraft are not broadcasting

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Aviation Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

OpenSky Python API and Impala interface — Programmatic access to historical state vectors and raw messages; unmatched for research, with query limits and a real learning curve.
tar1090 and readsb — Self-hosted receiver software producing local tracking and history from your own antenna; gives full provenance, limited to your own coverage.
dump1090 with an SDR receiver — Decodes aircraft surveillance broadcasts locally for lawful reception of a public safety broadcast; range is line of sight and terrain limited.
QGIS or Kepler.gl — Plots trajectories against terrain, airspace and infrastructure for analysis and briefing; requires care with projections over long routes.
Python with pandas and traffic library — Cleans, segments and analyses trajectory data reproducibly; the traffic library handles common aviation data quirks well.
Airframe history aggregators — Rapid lookup of registration and operator chronology; community-maintained, so always confirm consequential facts against the official registry.
Satellite imagery platforms — Confirms aircraft presence on aprons and detects based aircraft; revisit rate and cloud cover limit what can be confirmed on a given date.
Corporate registry search tooling — Resolves owner trustees and lessors across jurisdictions; coverage and machine readability vary enormously between registries.
Alerting scripts on address or registration — Notifies when a monitored airframe appears or changes registry; effective, though false alarms arise from address reuse and data errors.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Score Country Risk — Recomputes country risk from the weighted inputs and snapshots the result so movement over time is measurable.
Sync Intel Domains — Refreshes the reference and country-level intelligence datasets from their authorities.
Resolve Everything — Batch-resolves ASN, country, org and netblock for every IP from local reference datasets — no API calls, so it runs at millions of rows and works offline.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Track the address, not the tail. Registration marks change on sale and are deliberately churned to break continuity, while the ICAO 24-bit address and the manufacturer serial number follow the airframe. An investigation anchored on a tail number will lose the aircraft.
A gap is not a shutdown. Receiver coverage is thin over oceans, at low altitude and across large parts of Africa, Asia and South America. Model coverage before you interpret silence, or you will report routine physics as evasion.
Owner and operator are different questions. Trust-based registration is lawful and normal in several jurisdictions, so a trustee owner tells you almost nothing. The air operator certificate holder and the management company are where responsibility actually sits.
Registry moves are the highest-value events. A change of registry, especially into a jurisdiction offering ownership opacity, usually marks a change in real control and frequently precedes exactly the activity the investigation is interested in.
Corroborate presence before asserting it. A predicted or interpolated track is not evidence that an aircraft landed. Apron imagery, timestamped spotter photography, handling records or airport data turn a track into a documented presence.
Maintenance tells you about capability. Repeated unscheduled maintenance visits, lapsed airworthiness directives and long storage periods indicate an operation running at the margin, which is characteristic of grey market cargo work.
Publication timing carries risk. Near real time tracking of a specific aircraft can endanger people aboard and, for humanitarian and evacuation flights, the operation itself. Delayed publication usually costs nothing analytically and removes that risk.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Aviation Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of airframes in a portfolio resolved to serial number and permanent address rather than registration mark alone.
Share of consequential presence claims corroborated by an independent source such as imagery, photography or airport records.
Coverage-adjusted gap explanation rate, meaning the percentage of track gaps annotated with whether receiver coverage existed there.
Time from a monitored airframe's registry change or first appearance in a jurisdiction of interest to analyst notification.
Accuracy of ownership conclusions, tested against later confirmed disclosures such as designations, filings or litigation.
Number of designations, enforcement referrals or published reporting outcomes directly supported by aviation intelligence products in the period.
Rate of corrections issued for published movement claims, tracked as the discipline's characteristic error measure.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Treating coverage gaps as evidence of covert flight when ADS-B reception is simply poor over oceans, deserts and at low altitude
Assuming the registered owner is the operator, when trusts and leasing structures deliberately separate the two
Relying on a single tracking provider, since filtered services suppress aircraft on blocking programmes
Confusing callsign with operator, as callsigns are reused, leased and occasionally spoofed
Ignoring that military and state aircraft frequently operate with transponders off, making absence of data entirely expected
Publishing real-time tracking of individuals' private aircraft, which raises safety, harassment and privacy issues

Legal and ethical considerations

Receiving ADS-B is lawful in most jurisdictions because it is an unencrypted broadcast intended for public reception, but redistribution is governed by provider terms and some states restrict publication of state aircraft movements. Tracking identifiable individuals through private aircraft engages privacy law and, in some jurisdictions, anti-stalking provisions; keep the purpose legitimate and proportionate. Registry data is public but reuse for decisions about individuals may trigger data protection duties. Never interfere with, spoof or transmit on aviation frequencies, which is a serious criminal offence.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Aviation Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 5 data points, 3 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is receiving and using ADS-B data legal?

Reception is lawful in most jurisdictions because it is an unencrypted cooperative surveillance broadcast transmitted for reception by anyone, which is why it underpins so much open-source work. The constraints sit elsewhere. Redistribution of data obtained from an aggregator is governed by that provider's terms, some states restrict publication of state aircraft movements, and using movement data to monitor an identifiable individual engages privacy and, in some jurisdictions, anti-stalking law. Never transmit on aviation frequencies or inject false surveillance data, which is a serious criminal offence everywhere.

What does it mean when an aircraft disappears from tracking?

Usually that it flew out of receiver coverage, descended below the horizon of nearby receivers, or landed. Coverage is thin over oceans, deserts, polar routes and large parts of the global south, and low-altitude flight is invisible beyond short ranges. Genuine transponder shutdown does occur, but it is far rarer than commentary suggests and it is only assertable where coverage is demonstrably good at that place and time. Before writing anything about a deliberate gap, model the coverage, check a second network and look at the aircraft's own history of gaps.

How do I get behind a trust-registered aircraft?

Start with the registry document, which names the owner trustee and often the trustor or beneficiary in supporting filings. Then work the corporate layer: search the trustee's filings, the lessor, the operator's certificate records and any security interests recorded against the airframe. International registries of mobile equipment interests record financing parties. Handling agents, insurance filings, litigation and, frequently, the operator's own marketing reveal the real user. Report the structure accurately rather than implying illegality, because trust registration is lawful and extremely common in business aviation.

Can I use flight tracking to follow a named individual?

Only with a legitimate, documented purpose and a proportionality assessment, and even then with care. Tracking an aircraft is tracking an asset; tracking a person's movements through that aircraft is monitoring an individual, which engages data protection law in Europe and the UK and anti-stalking provisions in several US states. Journalism and accountability work concerning public figures usually has a defensible public interest basis; commercial curiosity about a private individual does not. Document the purpose before you start, minimise what you retain, and take legal advice for anything sustained.

Which tracking provider should I trust?

Use at least two, and understand what each filters. Commercial platforms honour blocking programmes and may exclude the aircraft an investigation cares about most, while unfiltered community networks carry more of the interesting traffic but with uneven coverage and retention. Research networks give raw messages, which is what you need when a conclusion will be challenged. Record which provider supplied each track segment, because when providers disagree, the disagreement itself is informative and usually reflects receiver geometry rather than one of them being wrong.

How do I confirm an aircraft actually landed somewhere?

Look for the descent profile ending at low altitude near the airport, then corroborate independently. Satellite imagery of the apron on or near the date, timestamped spotter photography, airport movement logs, handling agent records, notices to airmen and subsequent departure tracks from the same airport all serve. A track that simply ends in a coverage gap near an airport is suggestive, not conclusive. State the standard of evidence in the product, because the difference between suggestive and confirmed is exactly what a challenged story turns on.

What does an aircraft's maintenance history tell an analyst?

More than most people expect. Registration and airworthiness certificate status show whether the aircraft is legally flyable. Accident and incident records, outstanding airworthiness directives, long storage periods and repeated unscheduled maintenance visits indicate an operation running at the margin. Where a fleet shows deteriorating maintenance alongside continued high utilisation, that combination is characteristic of grey market cargo operations and of sanctioned operators unable to obtain parts and support, which is itself a strong indicator worth reporting.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ICAO Annex 7 on aircraft nationality and registration marks, which governs how airframes are identified and registered internationally.
ICAO Annex 10 on aeronautical telecommunications, which specifies the surveillance broadcast formats and the 24-bit aircraft addressing scheme.
Cape Town Convention and its International Registry of mobile equipment interests, which records financing and leasing interests in airframes and engines.
EU Regulation 2018/1139 and national civil aviation authority rules, governing airworthiness, operator certification and registration.
US Federal Aviation Regulations Part 47 and Part 91, covering registration including trust ownership and operating rules.
Data protection law including the UK GDPR and Regulation (EU) 2016/679, which applies to reuse of registry data and to monitoring identifiable individuals.
Sanctions regimes including OFAC and EU consolidated listings, which designate aircraft by registration and serial number and impose service prohibitions.
Berkeley Protocol on Digital Open Source Investigations, which sets provenance and preservation standards for open-source movement evidence used in accountability work.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

OpenSky Network research data — OpenSky Network. Open aircraft surveillance archive with raw messages and long historical retention for research use
ADS-B Exchange unfiltered tracking data — ADS-B Exchange. Community tracking network that does not filter blocked aircraft
Aircraft registration inquiry and downloadable registry — US Federal Aviation Administration. Authoritative US civil aircraft registry with owner, serial number and registration history
G-INFO aircraft register — UK Civil Aviation Authority. UK register of civil aircraft with owner, operator and certificate status
Aviation Safety Network database — Flight Safety Foundation. Accident, incident and hull loss records with airframe identifiers and narratives
ICAO standards and recommended practices — International Civil Aviation Organization. International standards for registration, addressing and surveillance broadcast formats
Accident investigation dockets — US National Transportation Safety Board. Factual reports containing maintenance, ownership and operational history of specific airframes
Network operations reports and traffic data — Eurocontrol. European air traffic statistics and network performance baselines
Air carrier statistics — US Bureau of Transportation Statistics. Segment and market data on carrier operations including aircraft type and airport pairs
Specially Designated Nationals list — US Office of Foreign Assets Control. Designations including aircraft identified by tail number and manufacturer serial number

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: resolves airframes to beneficial owners and reconstructs movement history with preserved, citable track evidence. Explore the platform, or browse the rest of the library by following any tag above.