The public's ability to use OSINT to track planes should not be underestimated by the RCMP.

( Cropped Pilatus PR Photo - underbelly of the PC-12 NG "Spectre" showing its electro-optical sensor)

At least one RCMP surveillance plane, believed to be outfitted with electo-optical night vision and thermal sensors, circled ~6000-7000ft over Kingston for almost two weeks in January, keeping residents awake, annoyed, and curious, all night long, while they were investigating a National Security case in Kingston.

It turns out the noise was from at least one nondescript, primarily white in colour, Royal Canadian Mounted Police Pilatus PC-12, registration number C-GMPB, ICAO Hex C065E0, and a serial number of 1304. C-GMPB departed London Ontario on January 4th headed toward Ottawa. On January 4th a local Kingstonian PlaneSpotter, Neil Aird, heard the plane, and checked his own ADS-B/Mode-S transponder receiver to catch the tail number as it flew overhead and around Kingston.

The same plane seemed to head home on January 7th, then back towards Ottawa January 8th, operating in the area until January 15th when the plane was flown back to Southern Ontario, to the Division "O" headquarters, but not before getting photographed by Neil on January 14th. I speculate the jaunt to London Ontario could have been a crew change, or something similarly practical and mundane.

Let's check in on the capabilities of the plane, which are naturally not mentioned by the RCMP. For cost savings, I suspect the plane is COTS, so we can refer to the marketing material around the two or three PC-12 "Spectre" variants the RCMP purchased. The last official number I could find was two, but I think more have been upgraded/converted or delivered since. The plane would have been outfitted with the top of the line IR/Electro-Optical and Thermal sensors. Here is their brochure; in short, they'll kit it out with whatever sensors you want, or leave you the hook ups exposed so you can customize it yourself. Glossy: here.

Below we have a sister-plane to C-GMPB taking off from Ottawa International YOW/CYOW in 2018. Notice the paint scheme is different from older RCMP planes with rainbow racing stripes.

C-FGMQ|ICAO:C01121|SN:1107

Here is another sister-plane to the aircraft that had been circling Kingston, on and off, from January 4th to January 14th, 2018. Notice the paint scheme; not the usual RCMP colours.

Reg:C-FMPA|ICAO:C02137|SN:1216

What did we learn from this?

• The RCMP have sixteen Pilatus PC-12 planes, and the same type of plane has several different configurations, with potentially overlapping duties. There is a surveillance variant called the "Spectre" and the RCMP has 2 of those on the books. I believe it's one of those that caused the din above Kingston. I have not been able to conclusively pick out the registration numbers of the two "Spectre" variants out of the 16 plane fleet, yet. (specs)
• Singled out as being the only single engine plane circling for over a week over a city makes you "overt", not "covert". Kingston has ~125,000 people, and more than a few noticed the RCMP was circling overhead and kept them awake all night for days; that's overt, not covert surveillance. I was contacted by a couple of people in Kingston who'd seen me written up previously (here, here, or here), but I really didn't think there would be such a paper trail for an RCMP surveillance aircraft, I thought they would have been super-stealthy. I guess not!
• Even before we knew the tail number from Neil's work, the plane operated all night long, that's a very specific behaviour. I ask you rhetorically, who else would possibly be flying, at 3 am, over Kingston in the cold. I live near the Carp Airport (CYRP) and twice a year helicopter pilots get re-certified for night operation or some other paperwork. They fly helicopters over the neighbourhood until ~10pm, and then go home - because they're human and have families to go home to. There is no activity, other than LEO, that would keep employees circling that long at that time in that pattern. I speculated it could be something corporate, doing some sort of survey,... but realistically, no. It's really likely any circling plane at 3am over any town of 125k people is some variety of LEO; local, provincial, national, or border services.
• The plane was circling for hours. Again, this is a behavioural tell.
  Take an example.. Sightseeing biplanes take off from CYRP; depending how much you want to spend, you can get a short tour, or a long tour of Ottawa. Either way, you're taking off from CYRP, flying around, and returning during the daytime, within a short-ish period. Minutes, not hours. There isn't anything that would justify circling for hours and days on end. The pattern of the plane's movement, the time, the altitude, this all paints a picture, but I still don't know why a white van parked across the street (yeah I know it's a movie trope) wouldn't be sufficient? SURE the plane is nice, but was it necessary? I don't know. That's past what I can realistically criticize, since they won't say why they needed the plane to begin with (even after today's 1pm press conference).
• Initially many wondered if it could have been military? With CFB Trenton so close, it seemed like it could have been, but Trenton has a transport squadron, and while there are other people who I'd rather not mention in the area, none that would do reconnaissance from a small plane that fits that description, that I'm aware of. I liked the idea they were testing a drone's optics or something, but that didn't pan out either. Early distant photos of the plane showed it was a small plane, that looked like a PC-12, but was not confirmed at the time.
• On January 4th the public (Neil in this case) knew that an RCMP operation was going on from the noise coming from their not-so-covert platform circling at < 7000ft for hours at night, by checking for the closest transponders that were beaconing in the area. The operational security implications of this are huge, as organised crime could easily look for all RCMP planes' presence in the future. I'm sure there are reasons why Mode-S has to be used, rather than being turned off entirely, which gives away the location of the plane, but shouldn't there be something they can do? Use a different mode? Neil is one of the good guys, and expecting the bad guys to not notice an RCMP plane circling overhead when they can precisely triangulate their position with < $1000 of computer gear bought off Amazon.

Why am I bringing all this up? Because nothing changes if you leave it alone. The RCMP is performing surveillance with a plane that's (figuratively) screaming "HEY! I'm with the RCMP and you're within line-of-sight of this transponder that's on a plane overhead, else your laptop wouldn't be able to hear me!", over 1090 MHz, over and over, as it circles all night long, if you're listening. I believe this was a good use case for why the RCMP needs a Predator-sized drone, which could fly higher, see farther, and loiter longer - drones don't eat or sleep. If the plane hadn't been noticed from its sound, nobody would have looked it up and tried to piece it together with relatively easily available present hobbyist technology.

Here's Global News talking with Neil, who's really the Plane-Spotter hero of this story, in my opinion.
Also, the title of the report should be "MYSTERY SOLVED!". Neil nailed it, and Steph Crosier first reported it in The Whig January 22nd 2018.

Appendix:

Snapshot of all Pilatus PC-12 planes in the RCMP inventory, per the Canadian Government. (source, source)

Brand	Model	Registration	ICAO	Serial
Pilatus	PC-12/45	C-FMPB	C02138	283
Pilatus	PC-12/45	C-GMPY	C065F7	311
Pilatus	PC-12/45	C-GMPP	C065EE	374
Pilatus	PC-12/47	C-FMPF	C0213C	768
Pilatus	PC-12/47E	C-GMPM	C065EB	1011
Pilatus	PC-12/47E	C-GMPX	C065F6	1017
Pilatus	PC-12/47E	C-GMPE	C065E3	1073
Pilatus	PC-12/47E	C-FMPK	C02141	1092
Pilatus	PC-12/47E	C-FGMQ	C01121	1107
Pilatus	PC-12/47E	C-GMPV	C065F4	1181
Pilatus	PC-12/47E	C-GMPO	C065ED	1197
Pilatus	PC-12/47E	C-FMPA	C02137	1216
Pilatus	PC-12/47E	C-GMPA	C065DF	1262
Pilatus	PC-12/47E	C-GMPQ	C065EF	1268
Pilatus	PC-12/47E	C-GMPB	C065E0	1304
Pilatus	PC-12/47E	C-GMPW	C065F5	1336

News:

2019-01-22 "Kingston's mystery plane captured on camera" (Kingston Whig Standard)

https://www.thewhig.com/news/local-news/kingstons-mystery-plane-captured-on-camera

2019-01-22 "Mystery plane that keeps flying over Kingston in the dead of night baffles citizens" (National Post)
https://nationalpost.com/news/canada/mystery-plane-that-keeps-flying-over-kingston-ont-in-dead-of-night-baffles-citizens

2019-01-23 "Kingston mystery plane solved?" (Global News)
https://globalnews.ca/video/4881340/kingston-mystery-plane-solved

You saw a ship on the news, but how do YOU find it using OSINT?

I've had some requests to walk people through, with more detail, how to look up ship-related information, and I'm not hiding any methods, the whole idea is for YOU to be able to loo up your own information for free (or for cheap), and not need to launch your own spy satellite.
(but if you have the chance, you really should - I'm looking at you Elon)

There are many, many, ways to skin this cat. I'm just going to go over one way as an example - this is by no means an exhaustive how-to. There are marine ship registries, forums, accident reports, all sorts of other resources - but I'm going to show you MarineTraffic.com and focus on AIS.

Let's take an article which was in the news and walk you through the process. The first thing is to figure out what is the subset of vessels, out of the tens of thousands presently at sea, that you're interested in. You need to scope out the breadth of your investigation. Here is a good start;

St Helena's cherished lifeline ship to return as anti-piracy armory

Joe Brock - APRIL 17, 2018 / 10:38 PM (original here)

JOHANNESBURG (Reuters) - The RMS St. Helena, Britain’s last working postal ship, was for nearly three decades the main source of contact between one of humanity’s remotest islands and the outside world.

Now the ship, cherished by the 4,500 residents of British-ruled St. Helena, will start a new life as a floating armory, packed with automatic weapons, bullet-proof jackets and night vision goggles, all stored for maritime security operatives.

Renamed the MNG Tahiti, the 340-foot ship will undergo some tweaks before sailing to the Gulf of Oman where it will be used to ferry guns and guards to passing vessels navigating stretches of water lurking with pirates, its new operator said on Tuesday.

“The ship is good to go with a few adjustments,” said Mark Gray, a former British Royal Marine and founder of floating armory firm MNG Maritime. “By the middle of the year we hope to have her operating.”

Tahiti Shipping, a subsidiary of MNG Maritime, bought the ship for an undisclosed fee on Tuesday, the St. Helena government said in a statement.

The construction last year of a commercial airport on the isolated island in the middle of the South Atlantic rendered the 156-passenger ship obsolete, prompting St. Helena authorities to put it up for sale and begin planning a gala farewell.

Before weekly flights to South Africa began in October, a five-night voyage to Cape Town on the RMS St. Helena was the only major transport route off an island made famous as the windswept outpost where French emperor Napoleon Bonaparte died.

The yellow-funnelled ship was purpose-built by the British government in 1989 to service the island and is the last of a royal mail fleet that once connected the far-flung tentacles of the old British Empire.

Its final voyage was marked with a public holiday on St. Helena, with flag-waving crowds gathering on the rocky coastline to catch one last glimpse of the ship that had delivered them everything from car parts to Christmas turkeys.

A flotilla of fishing vessels and yachts flanked the ship with those on board popping champagne corks as plumes of balloons were released into the sky to cheers from St. Helena residents, known locally as “Saints”.

“I fully appreciate the role this vessel has played in all Saints’ lives,” MNG Maritime’s Gray said. “It is not a responsibility we take on lightly. We will continue to treat her in the manner to which she has become accustomed.”

Writing by Joe Brock; Editing by Mark Heinrich (Reuters)

After reading that, do you have more questions than you started with? I sure do. First, how many ships like this does MNG Maritime and their subsidiaries have? What about other floating armouries? ...and where are they? Someone must have already made a list, hopefully with IMO or MMSI numbers which definitively identify the ships that might have duplicate names.

Web search engines like Google and Duck Duck Go will help you greatly, since none of these operations are in any way secret or covert, they are publicly discussed and licensed. These are extremely heavily armed vessels moored in strategic locations around choke points where there is high pirate activity.

Here is a fantastic resource:

"Stockpiles at Sea, Floating Armouries in the Indian Ocean"

SMALL ARMS SURVEY 2015, Chapter 8, Pages 216-241

written by Ioannis Chapsos and Paul Holtom

http://www.smallarmssurvey.org/fileadmin/docs/A-Yearbook/2015/eng/Small-Arms-Survey-2015-Chapter-08-EN.pdf

Google some more more and you'll soon find this:
https://seenthis.net/messages/688184

From those, you should have a list of a few dozen Vessels of Interest (see what I did there?)

Put all the vessel information you can find in a spreadsheet; with a little luck copy & paste works.

I'm going to use the IMO numbers because they're tied to the ship, whereas the MMSI number change with the registration and ownership. Sometimes you have access to one, or the other - always record both, and the callsign if you have it. Keeping a spreadsheet of the ships you've put information together about is essential. I recommend using Google Docs.

Now we come to the MarineTraffic.com portion of our lesson; 

Create an account, and if you're really into this, pay your yearly pound of flesh and get access to more than the free account offers.  First of all, you need a "fleet" of 50. Their basic account would provide you that. The "fleet" concept groups vessels in whatever category you would like, and allows you to control them in bulk groups easily.

Here are all the IMOs from the aforementioned floating armouries:

8112823

6524230

7027502

8965593

5278432

8107713

8107036

7313432

5427784

8701105

8129084

7406215

9606194

8131386

7412018

7624635

8413174

7353432

7709253

8206105

7911777

7115567

9050101

4908729

8410691

8912572

8333283

8301216

7932006

8003175

7319242

7636339

7392854

8333506

First, search for one of those ships, any one

Click the result, it will open up a details page on that ship

You want to make a new fleet, so click the down arrow beside "Add to default fleet" and scroll to the bottom, select "Add to new fleet". Name it something obvious, like "Floating Armouries"

Now, click the little person icon at the top right, and pull down to "My Fleets"

Select the Floating Armouries fleet you created previously. Notice the "import" line? That's what you want! That's why having a spreadsheet with the list of ships you're tracking is very handy.

Now you're presented with a big empty box for IMO or MMSI numbers; paste the whole list in that box. Any duplicates will disappear, so don't be too careful.

Import, and voila - you have a MarineTraffic fleet with all the Floating Armouries in it.

Then, you can show only the vessels in your fleet at the map view, and exclude all the others so you're not distracted.

You're ready to follow these, or other ships that match your interests, around the globe.

Did I cheat by using a pre-made list that someone else already published in a PDF? Yes. Absolutely. OSINT is all about that sort of "cheating". Use what others have already blazed the trail with, and add to that. There is no reason to start from scratch, but remember to both protect your sources, and credit them - those two things may seem at odds, because they are. I've offended people both by crediting, and not crediting them. I try to error on the side of giving credit publicly, unless someone tells me not to.

Happy hunting!

Tracking the Royal Canadian Air Force by transponder.

Royal Canadian Air Force ensign (wikipedia)

I'm not a serious plane-spotter. I'm not a serious amateur radio guy. I'm not ex-RCAF or a Canadian Forces veteran. However, I do have an appreciation for the military and technology, and use it for my research; so I wanted to share what I know with you, as well as write it down for my own future reference.

Commercial aircraft use ADS-B transponders to identify their location to other aircraft to avoid collisions; you can read up on the technology and history here. Military aircraft, from my understanding, have ADS-B transponders, but do not use them when they are operational, since it would give away their location. Additionally, some planes seem to use some features of the transponder, but not others; so you could have a plane that is beaconing coordinates, but not altitude, for example. This is an effort to obfuscate the information from evil-do'ers.  When a plane isn't transmitting its coordinates, MLAT (essentially triangulation) is used to estimate the plane's location if enough amateur radio receivers can pick up the signal of the plane.  The likelihood of that increases as the plane increases its altitude, since it can "see" more of the earth's surface from higher altitudes (the earth is round, eh).

But how do you, sitting at home, watch these planes' transponder signals?  There are several commercial providers, businesses, that for a small monthly fee, will allow you to track commercial, and some military, planes. FightRadar24.com, PlaneFinder.net, and surely many others.  I have used them, and I do use them, but they have a small problem. They're commercial businesses, and the militaries of the world are pretty smart; they have asked these businesses, to avoid any trouble, to NOT display their aircraft. To censor their feeds, so people can't see military aircraft flying over their houses. The military does so under the guise of Operational Security, OPSEC.  I respect the idea of OPSEC, but in this case it's likely not the reason to deny the public this information, since they are emitting the signal to begin with. If the issue was truly OPSEC, they would turn the transponder completely off, as they actually do when they are conducting operations in a war-zone.  The military doesn't want you asking questions about their air movements, and censoring the data commercially available, that they are blatantly broadcasting for anyone to hear with the right equipment, ensures you don't know what they're doing, and ensures you can't stay informed.

Except... There is a crowd-sourced web site, which isn't a commercial enterprise, called ADSBExchange.com. They run on a shoestring budget, and the reporting servers are down sometimes, but overall the system works. The following links will show you reports of the Royal Canadian Air Force's planes that have been caught by people triangulating, or receiving, ADS-B signals from Canadian military planes, worldwide.

ALL RCAF 
CC-177 
CC-130H/J 
CC-150 
CC-144 
CP-140 
CC-142 
CH-147

It seems these queries will only work when the system isn't under a lot of load. I find that early in the morning I have a better chance for these reports to work.