How Do You Track an Aircraft That Officially Does Not Exist?
How do you track an aircraft that officially does not exist? Start with the logistics. An aerospace project can keep its purpose secret, but personnel and hardware still have to move. Aircraft need routes, airspace coordination and places to land. Those movements leave traces a civilian researcher can examine through open-source intelligence, or OSINT.
Between late 2018 and mid-2019, researchers mapping suspected covert logistics ran into a basic problem: commercial flight-tracking displays could omit sensitive aircraft. That pushed the work toward receiver data captured directly from the airwaves. A missing aircraft on a public map tells you little about what flew overhead; a local recording gives you something you can test.
The discipline matters as much as the equipment. A flight near Area 51 may be routine military traffic. Keep the raw observation separate from any claim about its mission, then look for independent records that agree with it.
Tactic 1: Exploiting ADS-B Hex Codes and Multilateration
Automatic Dependent Surveillance-Broadcast, or ADS-B, lets an aircraft transmit information that nearby receivers can collect on the 1090 MHz band. A transmitted hex code can help you follow a recurring signal, even when a public display provides little detail. Some sensitive flights may keep a transponder active for traffic awareness. Others can change reported information or stop transmitting it, so treat the code as a lead rather than proof of identity.
Check the signal against the position
Multilateration, usually shortened to MLAT, offers a way to check a position without accepting an aircraft’s self-reported GPS coordinates. Separate ground receivers record when the same radio signal arrives. The time difference of arrival, or TDOA, allows a network to calculate where it came from.
Reliable TDOA positioning requires at least four synchronized ground receivers with overlapping coverage. One laptop by itself cannot produce that result. MLAT also needs a signal to receive; it cannot locate an aircraft that has stopped emitting altogether.
For an unusual track, preserve the hex code, reception times and whether each position came from ADS-B or MLAT. Comparing those records can expose a disagreement worth investigating. It cannot, on its own, name the aircraft’s operator.
Tactic 2: Monitoring Unencrypted VHF and UHF Frequencies
Radio can supply context when a position track goes quiet. Aircraft moving through controlled airspace still need to coordinate with air traffic control. Civilian aviation voice traffic uses VHF frequencies between 118.000 and 136.975 MHz; military aviation also uses portions of the UHF range from 225.000 to 399.950 MHz.
A software-defined radio, or SDR, can scan those bands and record brief unencrypted transmissions. Tower handoffs are particularly useful: a callsign heard during an airspace transition may give you a time marker to compare with a receiver log. Record what was actually said, including uncertainty in a clipped or noisy callsign. A plausible-sounding transcription can send an investigation down the wrong route.
Keep the radio record narrow
Set a scan around the relevant aviation channels and retain timestamps for any traffic you flag. Compare those times with aircraft tracks before drawing a connection. A callsign heard near a restricted area does not establish which aircraft used it unless the timing and other observations support the match. Follow the rules that apply to receiving and sharing radio communications where you live, and never transmit on aviation frequencies.
Tactic 3: Unmasking Aviation Shell Corporations via FAA Registries
A tail number gives you a different trail: paperwork. Look up a suspicious N-number in the FAA N-Number Inquiry database, then compare the listed owner with state corporate filings. Civilian companies can operate flights tied to sensitive government work, but a corporate name in a registry does not establish a covert mission.
- Save the N-number exactly as observed, with the date of the sighting.
- Check the aircraft registration and note the listed owner and address.
- Search the relevant state filing for incorporation details and its registered agent.
- Compare those records with other aircraft in your log, keeping each documentary link visible.
A PO Box, little public web presence, or a recently formed LLC can justify a closer look. So can a shared registered agent, especially when the same agent appears in records connected to a defense contractor. Investigators have used an 18-to-24-month incorporation window to narrow a search; it is a screening choice, not a test for a front company.
Ownership tracing is strongest when public filings still expose a meaningful link. Once ownership runs through layered holding entities, the registry may identify the legal operator while revealing little about who directs a flight. Keep that distinction in your notes.
Tactic 4: Analyzing Anomalous Patterns Near Restricted Airspace
Geofencing turns a map boundary into a repeatable observation. Draw a digital perimeter around a known Military Operating Area, or MOA, and monitor tracks approaching it. One useful watch zone extends in the ballpark of 15 nautical miles outside the published boundary. That distance defines where you collect alerts; it does not imply anything special about a flight that crosses the line.
A signal drop-off deserves scrutiny when the same aircraft repeatedly disappears near the same perimeter. Before labeling the disappearance suspicious, check receiver coverage, terrain and whether other aircraft also vanish there. A gap in the network can look remarkably like a deliberate transponder shutdown.
Compare repeated tracks, not isolated circles
Circular flight paths can indicate loitering, but the shape alone offers no mission description. Mark the coordinates, dates and local times, then compare the pattern with earlier activity in that area. Loitering concentrated between 0200 and 0400 local time, paired with recurring signal drop-offs, gives you a sharper question to investigate than either observation alone.
For a claim about an Area 51-related flight, keep the public airspace boundary, raw track and receiver-coverage map together. The combined record lets another researcher challenge your interpretation without having to trust a screenshot or a dramatic caption.
Tactic 5: Deploy Your Own ADS-B Ground Station Today
A local receiver gives you control over the first link in that evidence chain. Get an RTL-SDR USB dongle using the RTL2832U chipset and a vertically polarized 1090 MHz antenna. A Raspberry Pi or spare laptop can run the decoder and keep a continuous log. Place the antenna where it has a clear view of the sky, while keeping the computer and cabling protected.
- Connect the antenna to the dongle, then plug the dongle into the Raspberry Pi or laptop.
- Install software that supports the RTL2832U and decodes 1090 MHz ADS-B signals, using its current installation instructions for your operating system.
- Start the decoder and confirm that nearby aircraft appear in its local output. Check that it records timestamps and hex codes before leaving it unattended.
- Save the local observations. If you choose to share them, configure a compatible feeder for a decentralized tracking network and confirm what data it sends.
- For MLAT, join a network that coordinates synchronized receivers; the single station remains useful for direct reception while other nodes provide overlapping coverage.
Keep a short station log noting antenna moves, outages and clock problems. Those mundane details can explain a supposed disappearance months later. Connect the 1090 MHz antenna to your RTL-SDR dongle, start the decoder and save your first local aircraft log.
