January 11, 2023

Canadian Prime Minister Justin Trudeau's trip to Jamaica (Christmas 2022)

The Right Honourable Justin Trudeau is a hard working international leader, and if he wants to take a week off in Jamaica with his family, he sure can - and did.

On 2022-12-26 The Right Honourable Justin Trudeau and his entourage flew from Ottawa to Jamaica on RCAF CC-144D 144620.

The flight to Jamaica kept west of Cuban airspace on the way there.


source: https://globe.adsbexchange.com/?icao=c2c1fb&lat=21.044&lon=-82.644&zoom=6.9&showTrace=2022-12-26

On 2023-01-04 RCAF CC-144D 144620 was picked up by the global network of ADSBexchange receivers at 18:38Z, flying at 38,000ft over Cuba on the way back to Ottawa from Jamaica, which is notable because they avoided Cuban airspace on the way there.

source: https://globe.adsbexchange.com/?icao=c2c1fb&lat=31.885&lon=-78.772&zoom=4.7&showTrace=2023-01-04

The Canadian Prime Minister's travel is a frequent target for Canadian right-wing media who seek to portray it as excessive and costly, but by using the smallest, most modern, and economical jet in the RCAF fleet, the flight details show quite the opposite.

January 07, 2023

Aircraft tracking lessons from Zelenskyy's trip to Washington

The USAF have a couple of tricks up their sleeve that they can, and do, use to obfuscate aircraft movements, including VIP transport. How seldom they use these tricks to hide VIP travel would surprise you, so when they do, they're identifiable and draw attention to the aircraft. The tricks used by state aircraft to avoid observation by open source methods are not limited to the USAF and can be found being used, with varying levels of success, by other air forces worldwide.

The Trip

On December 21, 2022 Ukrainian President Volodymyr Zelenskyy flew to Washington on an American plane. The plane carrying him was distinctly operating outside the norm, providing the public with a fingerprint of what "abnormal" aircraft operations look like.

Disembarking


The aircraft shown by the press which Zelenskyy disembarked from is a USAF C-40 Clipper decorated in executive livery (an "Air Force One"-like paint job). The USAF have ~12 Clippers in different configurations, but we can identify them all. The US Navy have their own fleet of C-40 Clippers used frequently to move personnel domestically and internationally.

The USAF C-40 Clipper fleet

01-1940AE0945
01-2015AE115D
02-0201AE1165
02-0202AE1167
01-1941AE11F6
02-1942AE11F8
02-0203AE11FA
05-0730AE17EF
05-4613AE189A
05-0932AE189C
09-0540AE503D
(link)

The The USAF C-40 Clipper fleet also use ACARS; example courtesy of https://acars.adsbexchange.com



The Day Before

On the day before Zelenskyy was picked up and flown to the United States, his would-be plane took off from Joint Base Andrews, but didn't show up to open sources until they were over the Atlantic at ~02:14Z, entering British airspace, when they enabled ADS-B; USAF C-40B Clipper 01-0041 was flying as call sign SAM910, and laded at Ramstein Air Base in Germany.

Trick #1; don't fly using a transponder mode that's commonly visible to the public; from the time they departed JBA and arrived in UK airspace they likely flew using Mode-3A/3C; visible to ATC, but not commonly visible to the public. 👇



December 21, 2022

The next day the plane flew to Rzeszów-Jasionka Airport, in Poland, and apparently picked up Zelenskyy to fly him back to Joint Base Andrews. 👇



On the way back, after they passed through British airspace over the Atlantic Ocean, they reduced the amount of data being transmitted by their transponder to exclude their precise location data with ADS-B, and fell back to using simple Mode-S. 👇



Trick #2, stop transmitting precise location data when visibility isn't desired. Without precise ADS-B location data, the aircraft is only transmitting its altitude and identity using Mode-S, which would require multiple receivers to precisely geolocate using MLAT. 👇



You can see the same trick used by the RCAF when they fly operations over Iraq; they stop transmitting their precise location data and fall back to Mode-S reducing the precision with which they can be quickly geolocated.

Example: 2022-11-09 from 15:10Z to 18:22Z RCAF CC-130J Hercules 130604 flew over Iraq using Mode-S, not transmitting their precise location. 👇


Those are the two obfuscation techniques that I noticed were used and stood out to me. Looking for those tricks, they can be used as a behavioural fingerprint to identify the next VIP flight.

"Santa Tracker" stories perpetuate public ignorance.

Yes, bah humbug indeed. NORAD and other worldwide military organisations like having a little fun with the idea that Santa is flying though their airspace, and make cute videos depicting their planes intercepting him, his sleigh, and nine reindeer. Adorable.

However, the public can track almost all of the planes mentioned; most of the public don't know that.

Let's take NATO and allied tankers that are frequently used for refueling QRA intercepts. Portraying aircraft that use a publicly viewable transponders as involved in a Santa escort mission isn't just a bit of fun, it reinforces existing misconceptions about the visibility of military aircraft. For the RAF their Voyager tankers are almost always visible by their transponders, same with the RCAF, and the RAAF. Many, most of the public even, don't know that.

More than being a party pooper, I'd like to raise the bar; have the public discover almost all aviation is trackable in real time, and stop pretending we're living in a pre-internet age.

Just as a sample, you can click any of the hot links below and see right now if any of the following aircraft have been in the air in the past day. The list is a super-set of tankers and transport aircraft (eg RCAF 15004 and 15005 are the only tankers, the other three are just transports)

🇦🇺 RAAF Airbus KC-30A (A330-203MRTT) 

A39-001

7CF864

A39-002

7CF865

A39-003

7CF866

A39-004

7CF867

A39-005

7CF868

A39-006

7CF9C8

A39-007

7CF9C9

🇬🇧 RAF Airbus Voyager KC2 (A330-243MRTT) 

G-VYGJ

406B79

G-VYGK

406D26

G-VYGL

406D27

G-VYGM

406E9F

ZZ330

43C6F3

ZZ331

43C6F4

ZZ332

43C6F5

ZZ333

43C6F6

ZZ334

43C6F7

ZZ335

43C6F8

ZZ336

43C6F9

ZZ337

43C6FA

ZZ338

43C6FB

ZZ343

43C700

🇨🇦 RCAF CC-150 Polaris (Airbus A310)

15001

C2B355

15002

C2B35F

15003

C2B3B9

15004

C2B3C3

15005

C2B37D


November 30, 2022

CTV News denied even open-source levels of information by DND

A CP-140 Aurora aircraft, call sign Demon 02, patrols the Mediterranean Sea to help build maritime situational awareness in associated support of NATO’s Operation SEA GUARDIAN on April 11, 2022.     Please credit: Corporal Braden Trudeau, Canadian Armed Forces photo
From the statements made on behalf of DND about releasing even the most basic levels of detail about Op NEON, a 35 day operation that flew out of Kadena Air Base in Japan, I think we need to question the "national security" need to avoid publicising details about overt (not covert) operations. Aircraft flying as part of Op NEON can be categorized as overt from their transponder posture, identifying themselves as RCAF CP-140 Aurora 140103 to any receiver in line of sight of the aircraft, including space. Denying basic information for reasons of "national security" doesn't hold water for overt operations in 2022.

You should read this first:

Canadian military plane intercepted by Chinese jets 'numerous' times in recent weeks
by Todd Coyne 2022-11-29 for CTV News
https://vancouverisland.ctvnews.ca/chinese-jets-intercepted-canadian-military-plane-on-numerous-occasions-during-recent-deployment-1.6173803

In a statement credited to DND spokesperson Jessica Lamirande, CTV News was told for reasons of national security DND would be unable to answer questions about how often RCAF CP-140 Aurora 140103 was intercepted by the PLAAF during their Operation NEON sorties. DND also refused to give any details about when the CP-140 arrived to Kadena Air Base, when they left, how many flights they flew, how long the flights were, which of those flights were intercepted, on which day, or identify what kind of plane had done the interceptions, beyond saying the intercepts were “numerous”. Why? National security; operational security. To paraphrase, the public can’t know these details, or it would compromise the national security of Canada. I’m here to tell you that’s just not true, we have many of the details already. I think DND PA is misrepresenting the operation, taking an overt presence off the coast of China, and making it seem like a covert reconnaissance operation they couldn't possibly tell us about. There was nothing covert about the operation, so we can all talk about it; I documented the vast majority of the operation from my home office using publicly available information.

First, RCAF CP-140 Aurora 140103 landed at Kadena Air Base on 2022-10-04, and departed Kadena Air Base on 2022-11-07; they operated from Okinawa for 35 days. The DND spokesperson did not give that level of detail to Todd Coyne of CTV News for reasons of national security.

The Mode-S transmissions from the transponder of RCAF CP-140 140103 were picked up by the @ADSBexchange network of transponder receivers performing fifteen sorties from Kadena Air Base on the following days and approximate times:
  1. 2022-10-08 between 01:06 - 04:17 UTC
  2. 2022-10-09 between 00:58 - 07:46 UTC
  3. 2022-10-14 between 05:33 - 10:34 UTC
  4. 2022-10-15 between 04:15 - 08:15 UTC
  5. 2022-10-17 between 23:50 and 06:00 UTC on 2022-10-18
  6. 2022-10-19 between 01:40 - 09:15 UTC
  7. 2022-10-21 between 00:54 - 08:30 UTC
  8. 2022-10-22 between 00:54 - 08:41 UTC
  9. 2022-10-24 between 02:27 - 09:36 UTC
  10. 2022-10-25 between 02:08 - 09:59 UTC
  11. 2022-10-27 between 00:50 - 07:12 UTC
  12. 2022-10-28 between 00:52 - 07:46 UTC
  13. 2022-10-30 between 01:07 - 07:39 UTC
  14. 2022-10-31 between 00:51 - 07:21 UTC
  15. 2022-11-02 between 01:01 - 10:06 UTC
Provided I didn't miss any, that makes ~15 flights, totaling ~100 hrs of flight time. The DND spokesperson did not give that detail to Todd Coyne of CTV News for reasons of national security.

It is not reasonable to claim disclosing which of the above listed flights were intercepted is a threat to national security. The party who were doing the intercepting already knew the Canadians were there, that’s why they were being intercepted. The Canadian aircraft itself was broadcasting its own altitude and identity with their transponder. The crew were, at times, broadcasting their identity, location, and why they were there, over the radio in plain English. This was not a covert operation that the government isn't being forthright about; Op NEON is an overt operation done in plain view of China. There is no reason to limit what the Canadian public know about overt operations, up to the same level as would be reasonable for the adversary to know. How many times the RCAF flew sorties, and how many times they were intercepted, are very reasonable things for the Chinese gov't to know by now. They can draw from the same open sources as I do, as well as their national technical means.

In contrast, here is what was publicly and voluntarily disclosed in 2021 at the end of their fall Operation NEON deployment; not all, but many more details. (https://twitter.com/CFOperations/status/1466432046407036938)


While everyone can appreciate that Public Affairs is busy and doesn't have the time to research every little thing, Op NEON is a month+ long operation to monitor and identify ships smuggling goods to or from DPRK. It's a big deal. The public should be told how that went, at least to a level of detail comparable to what's available by way of public sources. Dismissing requests for the official version of events, up to the same level of detail available from public sources, claiming "national security", doesn't seem reasonable or well considered.

Outstanding questions for parity:
  • How many sorties were performed for Op NEON?
  • How many hours were flown during those sorties?
  • How many vessels of interest were identified?
  • How many possible illicit ship-to-ship transfers were observed?
Additional questions:
  • How many intercepts were performed by the PLAAF?
  • Were any of the intercepts considered unprofessional?
  • During which days were the CP-140 Aurora sorties intercepted?

February 12, 2021

An RCAF CC-177 took part in Operation Boxtop in early February, open sources confirm


One of the Canadian Forces' yearly operations is #OpBOXTOP, which refuels Canadian Forces Station Alert, and it takes place ~twice a year, using transport aircraft from 8 Wing / Trenton. Since the Government of Canada bought 5 CC-177 Globemaster III heavy transport aircraft (from 2007-2014), they have supplemented the CC-130 Hercules fleet which make frequent flights to CFS Alert. In order to fly in and land the extremely heavy plane, laden with fuel, they have to wait for the ground to be sufficiently frozen to accomodate the extra weight.

On February 11th 2021, Canadian Forces Operations (@CFOperations) published the following message on Twitter.
"From Jan 31 to Feb 5, a @RCAF_ARC CC-177 Globemaster III delivered ~78 000L of DF-8 fuel to Canadian Forces Station Alert to sustain station operations at the northernmost permanently inhabited place on earth! #OpBOXTOP"
-@CFOperations

This caught my eye because the number on the plane pictured is clearly visible, and all the aircraft's timelines should be well defined using open sources. Let's verify the flight history of the CC-177 fleet and figure out which of the five RCAF CC-177 Globemaster IIIs was used in early February to ferry fuel to CFS Alert.

We know Joint Task Force North (JTFN), with a presence in Whitehorse and Yellowknife, will be involved as part of the CFS Alert resupply mission, as would be 440 Transport Squadron, attached to 17 Wing / Winnipeg, but I hadn't noticed previous #OpBOXTOP missions going West, I usually see them fly North from Trenton. 

The tweet above contains a link which shows you, using the ADSBexchange web page, where all the Canadian Forces CC-177s have been today. Using those same identifiers you can use any aircraft tracking site you like to research their history. Below I provide links to Radarbox, which provides a history of the aircraft which is easily readable, then use ADSBexchange to confirm the data. That's two sources using different networks of physical receivers, ensuring redundancy and accuracy.

Radarbox
177701 (C2B3D7)
177702 (C2AFC7)
177703 (C2B3EB)
177704 (C2B3F5)
177705 (C2B3FF)

ADSBexchange
177701 (C2B3D7)
177702 (C2AFC7)
177703 (C2B3EB)
177704 (C2B3F5)
177705 (C2B3FF)

If you spend the time compiling that data into something usable, you map out the schedule like this; the yellow dates are when #OpBOXTOP's shipments were said to be taking place.

#OpBOXTOP2021-01-282021-01-292021-01-302021-01-312021-02-012021-02-022021-02-032021-02-042021-02-052021-02-062021-02-072021-02-082021-02-09
177701CFC3638TrentonCFC4044
177702CFC4001TrentonCFC4041
177703Trenton
177704CFC4002TrentonCFC3646Trenton
177705TrentonCFC4052

From this analysis the only flight that could possibly have been used is CFC3646, but that seemed unusual for #OpBOXTOP because it headed in the wrong direction for CFS Alert, at least for the part of the flight we could track using open-source tools.

On 2021-01-30 ~15:30 Z RCAF CC-177 177704, call sign CFC3646, took off from CFB Trenton


177704 landed at Eielson Air Force Base ~22:45 Z, 2021-01-30


Radarbox independently confirms the data


They departed 2021-01-31 ~02:00Z, and headed in the direction of Whitehorse, YT, not overtly towards Alert, but could have been picking up personnel for the trip.


No additional data was available from RadarBox


177704 doesn't reappear until 2021-02-08, in a direction that looks like they're coming from Yellowknife or Whitehorse, both locations of Forward Operating Locations.


ADSBexchange confirms the findings.


Flights to Alert are common, flights to Alert with the CC-177 are less common, only taking place ~twice a year. Callsigns used are usually CFC85 and CFC86. That information can be found in aircraft incident databases, like this one


If we feed those callsigns back into the Radarbox database, we have a list of all the Boxtop missions (and others to Alert, not just Boxtop missions) CFC85 and CFC86 (even CFC87 once)

Here is a flight by 177705 which I believe was an #OpBOXTOP mission flown on 2021-01-04; it's heading in the right direction for Thule or Alert.


Again confirmed by ADSBexchange, CFC85 returned 2021-02-06 as CFC86 (which seems to be routine)


Based on all that flight data I was unconvinced that the flights mentioned went to Alert, not just Yellowknife or Whitehorse; I needed something else to correlate with. What about previous years?

I learned that indeed part of #OpBOXTOP is being flown from Yellowknife to Alert, but I am sure part of the mission has previously been flown in from Thule, Greenland. I'm not sure what principally decides if they're going to fly supplies in from Thule vs Yellowknife, or both. At least I know for next time, and will keep an eye out for an authoritative answer regarding the difference between #OpBOXTOP via Yellowknife, vs via Thule. I still don't know why they went to Alaska along the way, that also seemed unusual to me.

My apologies to @CFOperations for not understanding where the mission was taking place, I had expected them to fly direct from Trenton as they had before. Public affairs do a great job and are frequently under appreciated by the public and the press.

"A Hercules C-130J is being off loaded as a C-177 Globemaster III lands at Canadian Forces Station (CFS) Alert. Both aircraft carry supplies for the station in support of Operation BOXTOP" Photo: MCpl Shilo Adamson (April 25, 2012) IS2012-4006-7
"A Hercules C-130J is being off loaded as a C-177 Globemaster III lands at Canadian Forces Station (CFS) Alert. Both aircraft carry supplies for the station in support of Operation BOXTOP"
Photo: MCpl Shilo Adamson (April 25, 2012)
IS2012-4006-7