
Geospatial
The sensor under the situation picture, and its anomaly detection: nine live feeds, four engines, two live graphs that forget.
Geospatial is a real-time service. It pulls aircraft, ships, satellites, radar scenes, fires, earthquakes, launches and coded events from public feeds, most of them without a key, and correlates them. Its live graphs, one for flights and one for ships, are held in memory and start empty after a restart; fires, vessel tracks and the infrastructure catalogue are kept on disk. A third graph, for satellites, exists and is empty: satellite data is stored but no longer linked.
Its job is anomaly detection: not “what is where”, but “where is something happening now that was not happening before”. The world is divided into cells of 200 kilometres. Every detection that lands in a cell raises that cell’s danger value; when the detections stop, the value decays. A cell that crosses a threshold becomes an alert. On top of the cells, a second analysis looks at the shape of the whole picture, and a third groups neighbouring hot cells into patterns.
The situation picture is the surface on top of this. Almost every layer shown there is read from here; four reference layers are fixed lists.
What goes in
Feed list as of 29 August 2026Ten collectors, nine of them without any key: the lab's rule is that a sensor must not depend on an account that can be closed. The one exception is the worldwide AIS stream, switched back on in August 2026 by decision. Ships are prefiltered before they enter: state vessels worldwide, everything inside the conflict zones.
| what | source | cadence | key |
|---|---|---|---|
| aircraft | ADS-B, three public mirrors, plus the military route | every 30 s | none |
| ships, worldwide | AIS stream | push, flushed every 30 s | key |
| ships, Finnish waters | DigiTraffic | every 3 min | none |
| satellites | SatNOGS orbital elements, propagated locally | propagated every 30 s, elements every 6 h | none |
| radar scenes | Sentinel-1 SAR via public STAC, ship detection on new scenes | polled hourly | none |
| fires | NASA FIRMS, VIIRS | every 10 min | none |
| earthquakes | USGS feed | every 5 min | none |
| coded events | GDELT | every 15 min | none |
| launches | Launch Library | every 15 min | none |
How the anomaly detection works
Four steps, each feeding the next. The service does not know what a place is; it only knows that more is happening there than the cell has seen before.
1. Cells and danger values
The map is cut into cells of 200 kilometres. Each detection that lands in a cell, a fire, an earthquake, a coded event, a ship contact, adds to that cell's danger value, called k. The rule is borrowed from immunology: a dendritic cell samples its surroundings and raises an alarm when danger signals outweigh safe ones. Here the k-value grows with the signals and decays when they stop. Thresholds turn it into low, medium, high or critical.
2. The shape of the whole picture
Take every event on the map as a point and connect points that lie close together. Count what remains: how many separate clumps of activity there are, and how many rings, activity around a quiet centre. Those two counts are the Betti numbers. Watched over time, they say whether the picture is fragmenting or merging. A tipping score adds whether the system is slowing down, which is what dynamical systems do before they flip.
3. Patterns across cells
Hot cells that sit next to each other are grouped into a correlated cluster, with a centre and an extent in kilometres. A hot cell with no hot neighbour is an isolated anomaly. A cluster that moves from one read to the next is a propagation.
4. Across domains
A flight, a vessel and a satellite pass that fall within 100 kilometres of each other are linked, so that a coincidence of three feeds can be seen as one thing.
What it holds
Read 8 October 2026Three graphs in memory, up to ten thousand nodes each, with decay: an edge that is not refreshed fades and is dropped. Nothing is written to disk. The numbers are the state at 03:43 UTC on the day of the read, not a daily total; a moment later they are different.
| graph | nodes | edges | edge types | decay |
|---|---|---|---|---|
| flights | 313 | 767 | proximity, converging, same operator | fast |
| vessels | 863 | 1,664 | proximity, converging | medium |
| satellites | 0 | 0 | same orbit | slow |
The satellite graph was empty at the moment of the read: its edges need two objects in the same orbit within the window, which is rare.
What comes out
Read 8 October 2026302 cells were active at the read, each 200 kilometres across. A cell is active while it holds signals; the count is not a window, it is the live set. Severity is the k-value against fixed thresholds.
Cells by severity
| critical | 69 |
| high | 23 |
| medium | 46 |
| low | 164 |
What feeds the cells
- fire233
- gdelt14
Counted per cell: a cell with fires and ships counts once for each.
Where it is hottest right now
One row per cell. k-value: the danger value, what all its signals added up to, minus decay. Signals: how many detections fed the cell. From: which feeds they came from.
| where | k-value | signals | from |
|---|---|---|---|
| 30.2°N, 47.4°E | 92.8 | 169 | fire |
| -3.0°N, -53.9°E | 36.3 | 138 | fire |
| -8.8°N, 142.0°E | 32.7 | 124 | fire |
| -3.4°N, 105.3°E | 30.0 | 106 | fire |
| -7.8°N, 139.1°E | 29.4 | 113 | fire |
| -11.3°N, -45.5°E | 27.9 | 95 | fire |
| Iran (Süd) | 22.9 | 37 | fire, gdelt |
| 24.8°N, 53.5°E | 15.3 | 26 | fire |
Coordinates, not place names: the engine does not know what is there, only that something is happening there. The column on the right says what fed the cell; a cell in the far north with thousands of fire signals is a wildfire, not a war.
Shape of the whole picture
The Betti numbers from step 2, read once at the snapshot.
| separate clumps of activity (Betti 0) | 57 |
| rings around a quiet centre (Betti 1) | 0 |
| tipping score | 0.50 |
| events the analysis was run on | 2,000 |
The tipping score is a reading, not a verdict: it rises when clusters merge and the picture slows down. It was tuned in March 2026, when satellites were taken out of it because they distorted it and the variance was normalised.
Patterns across cells
From step 3: clusters of neighbouring hot cells, single hot cells, and clusters that moved since the last read.
| correlated cluster | 23 |
| isolated anomaly | 37 |
Largest clusters
Centre of the cluster, how many cells it spans, the average danger value of those cells, and its extent.
| centre | cells | avg k | extent |
|---|---|---|---|
| 8.0°S, 56.6°W | 72 | 3.7 | 4,648 km |
| 12.0°S, 27.6°E | 55 | 2.1 | 3,305 km |
| 48.4°N, 26.1°E | 27 | 1.5 | 3,114 km |
| 30.0°N, 48.9°E | 19 | 10.3 | 2,074 km |
| 35.4°N, 90.7°W | 14 | 0.6 | 2,139 km |
| 1.7°S, 109.0°E | 10 | 5.1 | 1,652 km |