Geospatial
The sensor under the situation picture, and its anomaly detection: nine live feeds, four engines, two live graphs that forget.
- Good for
- Spots where something is happening now that was not happening before: aircraft, ships, fires, earthquakes and launches from public feeds, folded into cells of 200 kilometres.
- Measured
- Active anomaly cells and the nodes in each live graph are read from the running service at every snapshot, with the date of the read.
- The parts that are not working are shown too: the satellite graph is drawn empty, because it is.
- Open questions
- How many alerts point at something a person would call an event?
- How quickly does a real event show up as a hot cell?
Geospatial
One dot, one object in a layer at the moment of the read. Grey: a layer that shows at most 500 objects and reached that limit. Red: an empty layer.
1 of the 13 layers were empty at the moment of the read: active fires. The anomaly engine held 14 active cells, its flight, ship and satellite graphs 1,015 nodes.
3,541 objects in 12 of 13 layers the situation picture reads from this sensor, 2 of them at their display limit. The infrastructure catalogue, 62,926 objects kept on disk, is left out: it is a list, not a reading.
Source: Situation picture layers and the geospatial sensor, read by the daily snapshot
Measured 4 Nov 2026, 13:04 UTC
What it pulls in and what it keeps
Geospatial is a real-time service. It pulls aircraft, ships, satellites, radar scenes, fires, earthquakes, launches and coded events from public feeds, most of them without a key, and correlates them. Its live graphs, one for flights and one for ships, are held in memory and start empty after a restart; fires, vessel tracks and the infrastructure catalogue are kept on disk. A third graph, for satellites, exists and is empty: satellite data is stored but no longer linked.
Cells that heat up and cool down
- Detection. Lands in a cell of 200 kilometres.
- Danger value. Each detection raises it; when the detections stop, it decays.
- Alert. A cell that crosses a threshold.
- Shape and patterns. A second analysis reads the whole picture, a third groups neighbouring hot cells.
Its job is anomaly detection: not “what is where”, but “where is something happening now that was not happening before”. The world is divided into cells of 200 kilometres. Every detection that lands in a cell raises that cell’s danger value; when the detections stop, the value decays. A cell that crosses a threshold becomes an alert. On top of the cells, a second analysis looks at the shape of the whole picture, and a third groups neighbouring hot cells into patterns.
The situation picture is the surface on top of this. Almost every layer shown there is read from here; four reference layers are fixed lists.
What goes in
Feed list as of 29 August 2026Ten collectors, nine of them without any key: the lab's rule is that a sensor must not depend on an account that can be closed. The one exception is the worldwide AIS stream, switched back on in August 2026 by decision. Ships are prefiltered before they enter: state vessels worldwide, everything inside the conflict zones.
| what | source | cadence | key |
|---|---|---|---|
| aircraft | ADS-B, three public mirrors, plus the military route | every 30 s | none |
| ships, worldwide | AIS stream | push, flushed every 30 s | key |
| ships, Finnish waters | DigiTraffic | every 3 min | none |
| satellites | SatNOGS orbital elements, propagated locally | propagated every 30 s, elements every 6 h | none |
| radar scenes | Sentinel-1 SAR via public STAC, ship detection on new scenes | polled hourly | none |
| fires | NASA FIRMS, VIIRS | every 10 min | none |
| earthquakes | USGS feed | every 5 min | none |
| coded events | GDELT | every 15 min | none |
| launches | Launch Library | every 15 min | none |
How the anomaly detection works
Four steps, each feeding the next. The service does not know what a place is; it only knows that more is happening there than the cell has seen before.
1. Cells and danger values
The map is cut into cells of 200 kilometres. Each detection that lands in a cell, a fire, an earthquake, a coded event, a ship contact, adds to that cell's danger value, called k. The rule is borrowed from immunology: a dendritic cell samples its surroundings and raises an alarm when danger signals outweigh safe ones. Here the k-value grows with the signals and decays when they stop. Thresholds turn it into low, medium, high or critical.
2. The shape of the whole picture
Take every event on the map as a point and connect points that lie close together. Count what remains: how many separate clumps of activity there are, and how many rings, activity around a quiet centre. Those two counts are the Betti numbers. Watched over time, they say whether the picture is fragmenting or merging. A tipping score adds whether the system is slowing down, which is what dynamical systems do before they flip.
3. Patterns across cells
Hot cells that sit next to each other are grouped into a correlated cluster, with a centre and an extent in kilometres. A hot cell with no hot neighbour is an isolated anomaly. A cluster that moves from one read to the next is a propagation.
4. Across domains
A flight, a vessel and a satellite pass that fall within 100 kilometres of each other are linked, so that a coincidence of three feeds can be seen as one thing.
What it holds
Read 4 November 2026Three graphs in memory, up to ten thousand nodes each, with decay: an edge that is not refreshed fades and is dropped. Nothing is written to disk. The numbers are the state at 13:04 UTC on the day of the read, not a daily total; a moment later they are different.
| graph | nodes | edges | edge types | decay |
|---|---|---|---|---|
| flights | 325 | 414 | proximity, converging, same operator | fast |
| vessels | 690 | 1,500 | proximity, converging | medium |
| satellites | 0 | 0 | same orbit | slow |
The satellite graph is empty because satellite data has only been stored, not linked, since June.
What comes out
Read 4 November 202614 cells were active at the read, each 200 kilometres across. A cell is active while it holds signals; the count is not a window, it is the live set. Severity is the k-value against fixed thresholds.
Cells by severity
| critical | 1 |
| high | 1 |
| medium | 2 |
| low | 10 |
What feeds the cells
- gdelt12
- vessel1
Counted per cell: a cell with fires and ships counts once for each.
Where it is hottest right now
One row per cell. k-value: the danger value, what all its signals added up to, minus decay. Signals: how many detections fed the cell. From: which feeds they came from.
| where | k-value | signals | from |
|---|---|---|---|
| Gaza | 4.5 | 17 | gdelt |
| Iran (Süd) | 2.1 | 7 | gdelt |
| 55.8°N, 37.6°E | 1.8 | 7 | gdelt |
| 60.0°N, 100.0°E | 1.2 | 4 | gdelt |
| 35.8°N, 51.5°E | 0.8 | 4 | gdelt |
| Irak (Zentral) | 0.7 | 2 | gdelt |
| Ukraine (Süd) | 0.7 | 2 | gdelt |
| 10.0°N, 8.0°E | 0.7 | 3 | gdelt |
Coordinates, not place names: the engine does not know what is there, only that something is happening there. The column on the right says what fed the cell; a cell in the far north with thousands of fire signals is a wildfire, not a war.
Shape of the whole picture
The Betti numbers from step 2, read once at the snapshot.
| separate clumps of activity (Betti 0) | 44 |
| rings around a quiet centre (Betti 1) | 0 |
| tipping score | 0.47 |
| events the analysis was run on | 2,000 |
The tipping score is a reading, not a verdict: it rises when clusters merge and the picture slows down. It was tuned in March 2026, when satellites were taken out of it because they distorted it and the variance was normalised.
Patterns across cells
From step 3: clusters of neighbouring hot cells, single hot cells, and clusters that moved since the last read.
| isolated anomaly | 8 |
| correlated cluster | 3 |
Largest clusters
Centre of the cluster, how many cells it spans, the average danger value of those cells, and its extent.
| centre | cells | avg k | extent |
|---|---|---|---|
| 47.2°N, 33.8°E | 3 | 0.4 | 470 km |
| 33.9°N, 52.3°E | 2 | 1.6 | 439 km |
| 32.6°N, 35.1°E | 2 | 2.7 | 303 km |