Alright, we are back. Welcome to My Weird Prompts, episode two hundred eighty-eight. I am Corn, and sitting across from me in our somewhat chilly Jerusalem kitchen is my brother, Herman.
Herman Poppleberry, here and ready to dive into the deep end. It is actually quite a morning, Corn. I was up late looking at some interesting satellite passes over the region, and then Daniel sent us this prompt from his room across the hall.
Yeah, Daniel’s prompt really gets to the heart of the anxiety we sometimes feel living here. He was asking about open source intelligence, or OSINT, and specifically how we can look at all the data flying around the internet to figure out if a military buildup is just posturing, like deterrence, or if it is a signal of an imminent attack.
It is a brilliant question because the line between the two is incredibly thin. In the old days, you needed a spy in a trench coat or a high-altitude U-two plane to tell you what was happening. Today, we have teenagers on Twitter and flight-tracking enthusiasts on their laptops doing work that used to be the exclusive domain of the Central Intelligence Agency.
Right, and after what we discussed in episode two hundred eighty-seven about the myth and reality of Jerusalem, it feels especially relevant to look at how we perceive threats versus what the data actually shows. Daniel’s question isn’t just about the what, it is about the why. How do you tell the difference between a country saying, do not touch me, and a country saying, I am about to hit you?
Exactly. And to answer that, we have to look at the signals that are hard to fake. You can fake a speech, you can fake a tweet, but it is much harder to fake the logistics of moving ten thousand tons of fuel or setting up field hospitals. That is where the real story lives.
So let’s start there. If I’m an amateur analyst or just a concerned citizen looking at OSINT, what is the first thing I should be looking for? Is it the tanks? Is it the ships?
Most people start with the tanks, Corn. They see a video of a train load of armored vehicles moving toward a border and they think, here we go. But in the world of OSINT, we call that the shiny object. Governments often want you to see the tanks. That is deterrence. If I move a brigade of tanks to your border in broad daylight, I am sending a message. I want you to see them so you get scared and stop whatever you are doing.
So the visible buildup is actually a signal of deterrence rather than attack?
Often, yes. True imminent attacks usually prioritize surprise. If I am actually going to invade, I am moving those tanks at night, I am covering them with camouflage netting, and I am enforcing strict radio silence. The real signal of an attack isn’t the weapon itself, it is the logistical tail.
The logistical tail. Explain that. What does that look like in the data?
Think about what a soldier needs to actually fight for more than twenty-four hours. They need food, they need fuel, and tragically, they need medical support. If you see a massive buildup of armored vehicles, but you do not see fuel bladders, you do not see mobile bakeries, and you do not see field hospitals being set up near the front lines, it is probably a bluff. An army can move its tanks for a photo op, but it cannot sustain a war without that massive logistical backbone.
That reminds me of what we covered in episode two hundred eighty-three about the chain of custody for information. You have to verify the boring stuff. I remember during the lead-up to the invasion of Ukraine in early two thousand twenty-two, the OSINT community was obsessed with blood supplies.
Yes! That was a massive indicator. Satellite imagery showed the Russian military moving blood products toward the border. You do not move blood products for a training exercise. Blood has a shelf life. It is expensive to transport and maintain. When you start seeing mobile medical units and blood banks moving to forward positions, that is a flashing red light that someone expects casualties.
It is a dark thought, but it is a concrete signal. What about the air? We see people tracking planes all the time. I know you love your flight-tracking apps, Herman. What are the aviation signals that actually matter?
Aviation is fascinating because it is almost impossible to hide completely. Even if a military plane turns off its transponder, we have a global network of receivers run by volunteers, like the ones on ADS-B Exchange. The big one to watch for isn't the fighter jets. It is the tankers.
The tankers? The ones that refuel other planes?
Precisely. A fighter jet like an F-thirty-five or an F-fifteen has a relatively short range if it is carrying a full load of munitions. If a country is planning a deep strike, they need their tankers in the air. If you see a KC-one hundred thirty-five or a KC-forty-six Pegasus flying in a very specific pattern, like a racetrack orbit, just outside the target’s airspace, that is a huge signal.
Why is that a signal of an attack rather than just a patrol?
Because tankers are high-value, vulnerable assets. You do not put them in the air in those specific orbits unless you are supporting a large-scale aerial operation. If you see five tankers orbiting in different sectors, they are creating a gas station in the sky. That means they are expecting a lot of hungry jets to come through very soon.
And what about the cargo planes? The C-seventeens and the C-one hundred thirties?
That is the logistics again. If you see a bridge of cargo planes, literally one after another, flying from a major hub like Ramstein in Germany or Al Udeid in Qatar toward a volatile region, they are bringing in the parts, the munitions, and the people. Deterrence is usually a static posture. An attack is a dynamic movement. OSINT allows us to see that movement in near real-time.
You mentioned satellite imagery earlier. We have moved way beyond just looking at blurry pictures on Google Maps, right?
Oh, miles beyond. The biggest revolution in OSINT in the last few years has been Synthetic Aperture Radar, or SAR. Traditional optical satellites are like cameras; they need light and they cannot see through clouds. If it is a cloudy day over Tehran or Moscow, an optical satellite is useless. But SAR satellites, like the ones operated by companies like Capella Space or ICEYE, send down radar pulses. They can see through clouds, through smoke, and they can see at night.
So the old trick of waiting for a storm to move your troops doesn’t work anymore?
Not at all. In fact, if an adversary knows an optical satellite is passing over at ten in the morning, they might hide their assets. But SAR is much harder to hide from. It can even detect changes in the soil. If you move a heavy missile launcher across a field, the SAR can detect the minute changes in the ground texture where the tires or tracks pressed down. We can literally see the footprints of an army in the mud from space.
That is incredible. But it also leads to a lot of noise, doesn't it? I mean, if every movement is tracked, how do you keep from getting overwhelmed by false positives?
That is the challenge. That is why the best OSINT analysts look for a convergence of signals. You do not just look at one satellite image. You look at the satellite image, then you check the flight tracking, then you look at maritime data. Are the ships leaving port? If a navy is preparing for an attack, they often clear their harbors. Ships are sitting ducks in a pier. If you see a sudden, unannounced departure of major surface combatants, like destroyers or carriers, they are either heading to a safe zone or they are heading to a launch position.
What about the civilian side? We’ve talked a lot about military hardware, but what are the signals coming from the people on the ground?
This is where it gets really interesting and a bit more subtle. One of the classic OSINT signals is something called a NOTAM, which stands for Notice to Air Missions. These are alerts filed by aviation authorities to warn pilots of potential hazards. If a country suddenly issues a NOTAM closing a massive chunk of their airspace from the surface to fifty thousand feet, they are usually planning to fire something through that space.
Like a missile test?
Or a launch. If you see a NOTAM that covers a path from a known missile base out toward a sea or a border, and it is valid for a very narrow window of time, that is a tactical signal. But you also have to look at the embassies.
The diplomatic signals.
Yes. Look for what we call Warden Messages. These are security alerts sent by embassies to their citizens in a country. If the United States or the United Kingdom suddenly tells all their citizens to leave a country immediately on commercial flights while they are still available, that is a massive indicator. They have access to intelligence we do not, and when they make that call, the clock is ticking.
I remember seeing people on social media tracking something as simple as traffic jams.
Oh, the Google Maps traffic signal! That is a famous one. In February two thousand twenty-two, an OSINT researcher in California saw a massive traffic jam at three in the morning on the road from Belgorod to the Ukrainian border. He realized it wasn’t cars; it was a column of military vehicles that Google’s algorithm was interpreting as heavy traffic.
It is funny how these systems designed for our convenience become tools for intelligence. But there is also the economic side. Daniel mentioned the collapse of the Rial or other currencies. How does the economy signal an imminent conflict?
War is expensive, and it is also terrifying for capital. If the elites in a country know an attack is coming, they start moving their money out. You see a sudden spike in the black market exchange rate for dollars or euros. You might see a run on the banks. If the local population starts hoarding fuel and bread, they are sensing something. The wisdom of the crowd is a very real OSINT signal. People who live near military bases notice when the guards are suddenly wearing full combat gear instead of their usual uniforms. They notice when the lights stay on all night at the headquarters.
So it is about the break in routine.
Exactly. Intelligence is essentially the study of anomalies. If the routine is broken in three or four different sectors at once—military, logistical, diplomatic, and economic—then you are no longer looking at deterrence. You are looking at a countdown.
Let’s talk about the misconception of deterrence for a second. Some people argue that a massive, loud buildup is the best way to prevent a war. But couldn't that also be a cover for an attack? Like, I am going to hold a massive exercise every year until you get used to it, and then one year, the exercise just becomes the invasion.
That is the classic trap. It is called the exercise-to-invasion transition. We saw this with the Yom Kippur War in nineteen seventy-three and again with the invasion of Ukraine. The military holds a massive exercise, everyone gets used to the high state of tension, and the defenders get tired. They cannot stay on high alert forever. Then, when the defenders finally relax, the exercise turns into a real operation.
So how does OSINT distinguish between a routine exercise and that transition?
You look for the things that are not part of the exercise. Exercises usually have a predefined end date and a clear script. If the troops stay past the end date, or if they start moving into tactical formations that were not part of the announced drill, that is a signal. Another huge one is radio traffic. During an exercise, there is usually a lot of chatter. People are learning, they are making mistakes, they are talking to their commanders. But right before a real attack, everything often goes quiet.
Radio silence.
Total silence. If the signals intelligence, or SIGINT, monitors notice that the usual military frequencies have gone completely dark, it is often because the orders have already been given and everyone is in position. The silence is often louder than the noise.
That is chilling. It makes me think about the responsibility of the OSINT community. We’ve seen cases where people misinterpret signals and spread panic. How do we, as consumers of this information, filter out the noise?
You have to be incredibly skeptical. In a volatile region, there is a lot of intentional disinformation. Governments know we are watching. They might spoof their transponders to make it look like a plane is somewhere it isn't. They might move empty trucks to a border just to see how we react. The key is to look for the high-cost signals.
High-cost signals. Explain that.
A tweet is free. A transponder spoof is cheap. But moving a carrier strike group across an ocean? That costs millions of dollars in fuel and maintenance. Setting up a field hospital? That requires specialized personnel and equipment that you cannot easily replace. Those are high-cost signals. If a country is willing to spend that kind of political and financial capital, they are serious.
It is like a game of poker where the stakes keep rising.
Precisely. And in this game, the OSINT community is trying to see the cards through the reflection in the glasses. We are getting better at it, but we are still prone to being fooled by a good bluff.
Let's look at a specific scenario. Say we see a country moving short-range ballistic missiles toward a border. In the OSINT world, what is the follow-up question?
The follow-up is: where are the loaders? Ballistic missiles are huge, and once you fire them, you need specialized cranes and vehicles to reload the launchers. If you see the launchers but no reload vehicles, it might be a one-off strike or a show of force. But if you see the entire support ecosystem—the survey teams that mark out the launch sites, the security perimeters, the reloaders—then you are looking at a sustained campaign.
And what about the sea? We talked about ships leaving port, but what about the smaller things? Like sub-tenders or mine-layers?
Mine-laying is a massive red flag. If you see activity around a navy’s mine-warfare units, that is almost never deterrence. Mines are offensive or defensive tools of active denial. If you start seeing reports or satellite imagery of mine-laying vessels moving toward a strategic chokepoint, like a strait or a harbor entrance, the war has effectively already begun in the minds of the planners.
This is all very technical, Herman, and I love the detail. But for Daniel, who is sitting in his room probably looking at a dozen different Telegram channels, what is the practical takeaway? If he sees a headline saying, troops are moving, what should his next three clicks be?
Click one: Check the flight trackers for tankers and cargo bridges. If the gas stations in the sky are open, the planes are coming. Click two: Check for NOTAMs and embassy Warden Messages. If the pros are telling people to get out, you should listen. Click three: Look for the logistical tail on satellite imagery if you can find it. Are there field hospitals? Are there fuel depots? If those three things are happening simultaneously, then the situation has moved beyond deterrence.
And I would add a fourth: Check the local markets. If the people on the ground are panicking, if the currency is in a freefall, they often know something the rest of the world hasn't processed yet.
Absolutely. The human signal is often the most accurate because it is driven by the most basic instinct: survival.
It’s a lot to take in. I think about how this has changed even since we started this podcast. Back in the early episodes, we were talking about OSINT as this niche hobby. Now, it is a primary driver of the news cycle.
It is. And it has also created this weird feedback loop. Governments now know that we are watching them in real-time. Sometimes they use that to their advantage. They might intentionally leak a signal of deterrence to avoid a conflict, or they might use the noise of the internet to hide a real move. It is a hall of mirrors.
Which brings us back to the idea of the chain of custody. You have to know where the data is coming from. If a video of a tank column appears on Telegram, you have to geolocate it. Is it actually from today? Or is it a clip from an exercise three years ago?
That is the most common trick! Reusing old footage. A good OSINT analyst will look at the shadows, the weather, even the foliage on the trees to verify the date and time. If the trees have leaves but it is supposed to be January, you know the video is a fake.
Specificity is the enemy of the liar.
I love that. I am going to steal that for my next research paper.
Go for it. So, looking ahead, where does this go? Are we going to reach a point where surprise is impossible?
We are getting close to a world of radical transparency. It is becoming very hard to hide a large-scale military operation. But that doesn't mean we can always predict the outcome. You can see the pieces moving on the board, but you still don't know the intent of the player. That is the one thing OSINT cannot fully capture yet: the human heart and the final decision of a leader.
That is a perfect place to pivot to some practical takeaways for our listeners. If you are following a developing situation, how do you stay informed without losing your mind?
First, curate your sources. Do not just follow every account with a blue checkmark. Look for established OSINT researchers who have a track record of being right—and more importantly, a track record of admitting when they are wrong. People like the team at Bellingcat or specific academic researchers who specialize in satellite imagery.
Second, avoid the urge to share everything immediately. The first hour of any crisis is filled with misinformation. If you see something shocking, wait ten minutes. Usually, the debunking follows shortly after.
Third, learn the basics of the tools. You do not have to be an expert, but knowing how to look up a flight on Flightradar twenty-four or how to find a NOTAM can give you a lot of agency. It moves you from being a passive consumer of news to an active participant in understanding the world.
And finally, remember the context. A single signal is just a data point. You are looking for a pattern. If the pattern is inconsistent, be wary.
This has been a heavy one, Corn. But I think it is important. Especially living where we do, understanding these signals isn't just an intellectual exercise. It is part of our daily life.
It really is. And Daniel, thanks for the prompt. It kept us busy all morning. I think I need another coffee, though. This one is definitely cold now.
I’ll join you. I think I saw some fresh beans in the pantry.
Perfect. Well, if you have been enjoying My Weird Prompts, we would really appreciate it if you could leave us a review on your podcast app or on Spotify. It genuinely helps other people find the show and helps us keep these deep dives going.
Yeah, it makes a huge difference. We love seeing the community grow.
You can find all our past episodes, including the ones we mentioned today, at our website, myweirdprompts.com. We have an RSS feed there and a contact form if you want to send us a prompt like Daniel did. We are also on Spotify, obviously.
This has been My Weird Prompts. I am Herman Poppleberry.
And I am Corn. Thanks for listening, everyone. We will see you in the next one.
Until next time! Stay curious and keep watching the signals.
Peace.
