⏱️ Lectura: 11 min
On May 12, 2018, a group of Australian ham radio operators registered the domain we now know as SondeHub, sondehub.org, as a joke: the page simply redirected to Habhub, a community site, with a filter that showed weather radiosondes instead of amateur balloons.
📑 En este artículo
Eight years later, SondeHub accidentally ended up mapping military installations, helped track the balloon the United States shot down with an AIM-9X Sidewinder missile in 2023, and today detects traffic its operator links to the war in Ukraine.
TL;DR
- On May 12, 2018, sondehub.org was registered as a simple joke redirect to Habhub.
- Since 2020, SondeHub has replaced Habhub as the actual backend for tracking weather radiosondes.
- The “reverse prediction” technique calculates a balloon’s launch point by running the wind model backward.
- That same technique inadvertently revealed the locations of military installations and ships at sea.
- In 2021, a military entity asked SondeHub not to mark a sensitive installation on the public map.
- On February 11, 2023, the United States shot down a ham radio balloon with an AIM-9X Sidewinder missile.
- Since December 2024, SondeHub has logged weekly traffic bursts against its API from a single IP.
- The project’s operator links part of that traffic to the war in Ukraine and reduced the precision of the published data.
What Happened
SondeHub looks, on the surface, like a hobbyist project: it tracks radiosondes, the small transmitters that hang from weather balloons and send temperature, pressure, humidity, and GPS position as they rise until they burst in the stratosphere. But since December 2024, the team started receiving alerts for unusual usage spikes, concentrated in its trajectory prediction system.
The pattern repeated every week. After enabling request logging, the team found the traffic was coming from a single IP address. The first suspect was a private company using SondeHub’s backend without permission to generate its own predictions; after contacting them, they confirmed the misuse, but that company wasn’t the main source of the problem.
Xssfox, who administers the project’s infrastructure, published an analysis with the coordinates of those requests (with precision deliberately reduced) and concluded that the pattern matched activity related to the war Russia started in Ukraine in 2022. The author admits they delayed publishing this story until, in their words, “the balloon war became more publicly known,” a phrase that makes clear there’s more context than what’s revealed in detail.
SondeHub’s Background and History
To understand how a domain registered as a joke ended up in the middle of a geopolitical conflict, we need to go back to 2017, when Australian ham radio operator Mark VK5QI introduced xssfox to high-altitude balloon chasing. At the time, the Australian balloon-chasing community was small and relied on Habhub, a site built for amateur balloons, not official weather radiosondes.
Over time, more and more radiosondes started showing up on Habhub, to the point that its administrators added a filter to hide them by default. sondehub.org was born on May 12, 2018 with a single purpose: redirect to Habhub with that filter disabled via URL. Nothing more.
Habhub was never designed for the number of unique balloons that started showing up every day. In July 2018, the team started proxying radiosonde ingestion data through SondeHub, which let them capture more data without the rate limits they had previously imposed on themselves. That data went into a separate OpenSearch cluster that, at the time, was more of a personal experiment with Amazon Web Services (AWS) than an actual service.
In 2019, both Habhub and aprs.fi (another service used to complement tracking) were at capacity. That same year, the team noticed a suspicious drop in radiosonde launches that they initially attributed to a bug of their own: it coincided with the GPS week rollover date. It turned out to be a hardware problem from manufacturer Vaisala, not their software, which handled the rollover without issues.
Between 2020 and 2021, SondeHub built APIs compatible with Habhub’s frontend and started testing them in parallel. It worked well enough to receive the full dataset, not just a portion, and publish it in open access via Amazon S3. They also launched their own trajectory predictor, the piece that, without planning it, would become the center of this story. When Habhub shut down due to lack of maintenance, SondeHub was already fully ready to absorb its community.
Technical Details: How Reverse Prediction Works
With their own predictor up and running, Mark developed what the team calls reverse prediction. The idea is simple to explain and powerful in practice: instead of using the wind model to predict where a balloon already in the air will land, they run the same model backward in time from the first position data received. The result is a reasonable estimate of where that balloon took off.
This technique proved extremely effective for benign use: identifying dozens of radiosonde launch sites that weren’t well documented publicly, and automatically assigning each balloon to its station of origin. But the wind model doesn’t distinguish between meteorology and ballistics. The same data that predicts where a balloon will land also works to calculate artillery ranging, that is, adjusting artillery fire based on wind direction and speed across different atmospheric layers.
Without meaning to, SondeHub had started mapping artillery battery positions. In 2021, they received an email diplomatically asking them not to explicitly mark a facility classified as sensitive on the map. The team settled on a middle-ground policy: keep the reverse prediction system active, but remove launch sites from the public map when they receive a verifiable legitimate request. The same technique also let them incidentally detect the position of military ships at sea.
On the infrastructure side, the project added WebSocket and MQTT support to offer live feeds, and fully separated Habhub’s backend from its own proxy. Part of the funding came from ARDC (Amateur Radio Digital Communications), which granted funding to build a prototype version of SondeHub focused on high-altitude amateur balloons, separate from official weather radiosonde tracking.
flowchart TD
A["Radiosonde transmits GPS in flight"] --> B["SondeHub captures the trajectory"]
B --> C["Wind model runs backward"]
C --> D["Reverse prediction: estimated launch site"]
D --> E{"Is it a sensitive facility?"}
E -->|"Yes, with verified request"| F["Removed from public map"]
E -->|"No"| G["Stays visible on SondeHub"]How to Try It
You don’t need to be a ham radio operator to see this in action. SondeHub publishes its map and much of its data openly.
- Go to sondehub.org and turn on the live map: you’ll see markers moving in real time, each one a radiosonde in flight somewhere in the world.
- To query raw data, use the public API with any HTTP client.
# Windows (PowerShell), macOS, and Linux: the same command works on all three
# because curl has been included natively since Windows 10 build 1803
curl "https://api.v2.sondehub.org/sondes/live"That endpoint returns a JSON with the latest reported position of each active radiosonde on SondeHub’s public network: latitude, longitude, altitude, and timestamp.
# Example in Python: filter only radiosondes above 20 km
import requests
datos = requests.get("https://api.v2.sondehub.org/sondes/live").json()
estratosfericas = [s for s in datos.values() if s.get("alt", 0) > 20000]
print(f"Radiosondes above 20 km right now: {len(estratosfericas)}")To confirm you’re seeing live data and not a stale response, check that the time field of each record corresponds to the last few minutes, not hours ago.
💡 Tip: SondeHub’s full historical dataset is available on Amazon S3 in open access, useful if you want to analyze your own launch patterns without hitting the live API.
Impact and Analysis
SondeHub’s case exposes a problem rarely discussed outside ham radio circles: dual-use data. A wind model works exactly the same for forecasting weather as it does for calibrating artillery, and there’s no technical way to separate the two uses at the source. The same dilemma applies to the ship positions the system detects as a side effect of its calculations.
2023 was the year this hobbyist project landed on governments’ radar. During the incident known as the Chinese spy balloon, SondeHub saw a traffic spike that its architecture managed to absorb without going down. Then, on February 11, 2023, the United States shot down what turned out to be a ham radio balloon, not a military threat, with an AIM-9X Sidewinder missile. SondeHub was mentioned in a Washington Post story that day, and its traffic spiked again, this time without warning.
From that point on, the team started receiving inquiries from .mil and .gov addresses, plus requests from the aviation industry and control towers. That turned a personal project maintained by volunteers into a piece of infrastructure that governments, airlines, and, as its own operators suspect, state actors linked to the war in Ukraine actively consult.
⚠️ Heads up: SondeHub doesn’t have the budget or staff of a critical infrastructure company. It’s still, essentially, a handful of volunteers deciding case by case which data to hide and who to trust when someone asks to have a site removed from the map.
That’s the project’s real limit: there’s no formal process to verify whether a sensitive-facility request is legitimate or an attempt to hide something that should be public. The team relies on the good judgment of whoever administers the system, which works at the current scale, but wouldn’t necessarily hold up if the volume of requests grew at the same rate as the suspicious traffic detected since 2024.
What’s Next
Xssfox themselves acknowledges deliberately delaying the publication of this story and reducing coordinate precision on purpose, until the balloon war became more publicly known. That leaves open the question of how much more lies behind the traffic spikes detected since December 2024, and what technical countermeasures the team applied beyond lowering the resolution of the exposed data.
For the ham radio and amateur meteorology community, the concrete outcome matters less than the precedent: a project born as a joke is now part of the infrastructure closely watched during geopolitical tension, alongside things like maritime AIS traffic or civil aviation ADS-B. The next time seemingly harmless data gets published openly, it’s worth asking who else might be using it, and for what.
📖 Summary on Telegram: View summary
Try it yourself: go to sondehub.org right now, turn on the live map, and see how many radiosondes are in the air over your country at this moment.
Frequently Asked Questions
What is a radiosonde?
It’s a small transmitter that hangs from a weather balloon and sends temperature, humidity, pressure, and GPS position as it ascends, until the balloon bursts due to low atmospheric pressure in the stratosphere.
What is reverse prediction?
It’s running the same wind model SondeHub uses to predict where a balloon will land, but backward in time from the first position data, to estimate where it took off.
Why does wind data help calculate artillery?
Because wind in different atmospheric layers deflects a projectile’s trajectory the same way it deflects a balloon; the same weather data feeds artillery firing tables.
Does SondeHub publish this data openly?
Yes, live position data and much of the historical data are available via API and on Amazon S3, though the team reduced the precision of certain data for security reasons following the incidents described in this article.
What happened to the balloon shot down in 2023?
On February 11, 2023, U.S. fighter jets shot down what turned out to be a ham radio balloon with an AIM-9X Sidewinder missile, amid widespread alert over that year’s Chinese balloon incident.
How is SondeHub connected to the war in Ukraine?
Since December 2024, the team has detected weekly recurring traffic against its predictions API from a single IP, a pattern its operator links to activity related to the war Russia started in Ukraine in 2022.
References
- Sprocketfox (xssfox): the original post where SondeHub’s administrator tells the full story of the project and recent incidents.
- Wikipedia: technical explanation of what a radiosonde is and how it works.
- Wikipedia: timeline of the 2023 Chinese balloon incident that spiked traffic to SondeHub.
- Wikipedia: technical specs of the AIM-9X Sidewinder missile used to shoot down the ham radio balloon.
- ARDC (Amateur Radio Digital Communications): the organization that funded the development of the SondeHub version dedicated to amateur balloons.
📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Imagen destacada: Foto de Oleh Holodyshyn en Unsplash
0 Comments