Geospatial
The sensor under the situation picture, and its anomaly detection: nine live feeds, four engines, three graphs that forget.
Geospatial is a stateless real-time service. It pulls aircraft, ships, satellites, radar scenes, fires, earthquakes, launches and coded events from public feeds, most of them without a key, and correlates them. It keeps nothing on disk: after a restart it starts empty and reaches a steady state again after a while.
Its job is anomaly detection: not “what is where”, but “where is something happening now that was not happening before”. The world is divided into cells of 200 kilometres. Every detection that lands in a cell raises that cell’s danger value; when the detections stop, the value decays. A cell that crosses a threshold becomes an alert. On top of the cells, a second analysis looks at the shape of the whole picture, and a third groups neighbouring hot cells into patterns.
The situation picture is the surface on top of this. Every layer shown there is read from here.
What goes in
Feed list as of 29 August 2026Ten collectors, nine of them without any key: the lab's rule is that a sensor must not depend on an account that can be closed. The one exception is the worldwide AIS stream, switched back on in August 2026 by decision. Ships are prefiltered before they enter: state vessels worldwide, everything inside the conflict zones.
| what | source | cadence | key |
|---|---|---|---|
| aircraft | ADS-B, three public mirrors, plus the military route | every 30 s | none |
| ships, worldwide | AIS stream | push, flushed every 30 s | key |
| ships, Norwegian coast | Kystverket NMEA stream, positions and static messages | flushed every 30 s | none |
| ships, Finnish waters | DigiTraffic | every 3 min | none |
| satellites | SatNOGS orbital elements, propagated locally | propagated every 30 s, elements every 6 h | none |
| radar scenes | Sentinel-1 SAR via public STAC, ship detection on new scenes | polled hourly | none |
| fires | NASA FIRMS, VIIRS | every 10 min | none |
| earthquakes | USGS feed | every 5 min | none |
| coded events | GDELT | every 15 min | none |
| launches | Launch Library | every 15 min | none |
How the anomaly detection works
Four steps, each feeding the next. The service does not know what a place is; it only knows that more is happening there than the cell has seen before.
1. Cells and danger values
The map is cut into cells of 200 kilometres. Each detection that lands in a cell, a fire, an earthquake, a coded event, a ship contact, adds to that cell's danger value, called k. The rule is borrowed from immunology: a dendritic cell samples its surroundings and raises an alarm when danger signals outweigh safe ones. Here the k-value grows with the signals and decays when they stop. Thresholds turn it into low, medium, high or critical.
2. The shape of the whole picture
Take every event on the map as a point and connect points that lie close together. Count what remains: how many separate clumps of activity there are, and how many rings, activity around a quiet centre. Those two counts are the Betti numbers. Watched over time, they say whether the picture is fragmenting or merging. A tipping score adds whether the system is slowing down, which is what dynamical systems do before they flip.
3. Patterns across cells
Hot cells that sit next to each other are grouped into a correlated cluster, with a centre and an extent in kilometres. A hot cell with no hot neighbour is an isolated anomaly. A cluster that moves from one read to the next is a propagation.
4. Across domains
A flight, a vessel and a satellite pass that fall within 100 kilometres of each other are linked, so that a coincidence of three feeds can be seen as one thing.
What it holds
Read 3 September 2026Three graphs in memory, up to ten thousand nodes each, with decay: an edge that is not refreshed fades and is dropped. Nothing is written to disk. The numbers are the state at 03:41 UTC on the day of the read, not a daily total; a moment later they are different.
| graph | nodes | edges | edge types | decay |
|---|---|---|---|---|
| flights | 3,590 | 14,224 | proximity, converging, same operator | fast |
| vessels | 1,226 | 1,789 | proximity, converging | medium |
| satellites | 0 | 0 | same orbit | slow |
The satellite graph was empty at the moment of the read: its edges need two objects in the same orbit within the window, which is rare.
What comes out
Read 3 September 202673 cells were active at the read, each 200 kilometres across. A cell is active while it holds signals; the count is not a window, it is the live set. Severity is the k-value against fixed thresholds.
Cells by severity
| critical | 1 |
| high | 1 |
| medium | 5 |
| low | 66 |
What feeds the cells
- gdelt12
- flight3
- fire1
- vessel1
Counted per cell: a cell with fires and ships counts once for each.
Where it is hottest right now
One row per cell. k-value: the danger value, what all its signals added up to, minus decay. Signals: how many detections fed the cell. From: which feeds they came from.
| where | k-value | signals | from |
|---|---|---|---|
| 32.1°N, 34.8°E | 12.1 | 17 | gdelt |
| Iran (Süd) | 2.5 | 4 | gdelt |
| 55.8°N, 37.6°E | 1.6 | 2 | gdelt |
| Ukraine (Zentral) | 1.6 | 2 | gdelt |
| Iran (Süd) | 1.6 | 2 | gdelt |
| Iran (Süd) | 1.6 | 2 | gdelt |
| 33.3°N, -116.2°E | 1.1 | 3 | fire |
| Irak (Nord/Kirkuk) | 0.8 | 1 | gdelt |
Coordinates, not place names: the engine does not know what is there, only that something is happening there. The column on the right says what fed the cell; a cell in the far north with thousands of fire signals is a wildfire, not a war.
Shape of the whole picture
The Betti numbers from step 2, read once at the snapshot.
| separate clumps of activity (Betti 0) | 72 |
| rings around a quiet centre (Betti 1) | 0 |
| tipping score | 0.62 |
| events the analysis was run on | 2,000 |
The tipping score is a reading, not a verdict: it rises when clusters merge and the picture slows down. It was tuned in March 2026, when satellites were taken out of it because they distorted it and the variance was normalised.
Patterns across cells
From step 3: clusters of neighbouring hot cells, single hot cells, and clusters that moved since the last read.
| correlated cluster | 11 |
| isolated anomaly | 21 |
Largest clusters
Centre of the cluster, how many cells it spans, the average danger value of those cells, and its extent.
| centre | cells | avg k | extent |
|---|---|---|---|
| 61.6°N, 24.0°E | 12 | 0.2 | 976 km |
| 52.3°N, 6.1°E | 10 | 0.4 | 1,227 km |
| 42.6°N, 78.9°W | 7 | 0.3 | 1,341 km |
| 35.8°N, 113.7°W | 5 | 0.5 | 830 km |
| 40.5°N, 121.0°W | 3 | 0.3 | 503 km |
| 36.9°N, 77.2°W | 3 | 0.3 | 401 km |