Deep Dive · Signals & privacy

The Plane Overhead Is a Fingerprint

An inaudible Doppler curve left by propeller aircraft is the strongest geolocation clue most people have never considered — and it survives high-pass filters, loud foreground noise, and phone compression. One demonstrated search pinned a recording to a couple of hundred feet using a single minute of audio in which you cannot hear the plane. The methodology, the one subtle physics mistake that would break it, and why every obvious defence is the wrong one.

Sound that leaks your exact location — video thumbnail
Video: colsto 29:12 2 November 2026
OSINT ADS-B Doppler side channels

📍 The claim 0:00

The challenge: a static video with no visual change, no landmarks, no metadata worth the name. The only given information is a date (8 September) and "somewhere in the continental US". The goal is a street-level match.

The tool is not a landmark or a shadow. It is the Doppler curve of aircraft flyovers, present in the audio at frequencies you cannot hear, at a level you cannot notice.

"When you hear a plane fly over, you're probably in the only place on Earth hearing that exact curve. And all the information needed to recreate that exists."
Editorial note on scope. This article explains the method as the video does and stops where the video stops: no code, no thresholds, and no coordinates for the location that was located. Reproducing a private camera's exact position would turn a demonstration of a side channel into a doxxing tool, and the author deliberately withholds his tooling too ("no code or tools are being released"). The interesting content is the reasoning, not the recipe.

🔊 Why Doppler beats thunder 0:41

The same researcher previously geolocated recordings by thunder. Thunder has excellent reach — it travels far and penetrates structures — but the best it gave was around 5 km of precision: enough for a city and a side of town.

SignalReachPrecisionWhy
ThunderVery good~5 kmA single boom with no fine structure to fit
Aircraft Doppler curveVery goodTens of metresShape encodes speed and closest-approach distance; timing encodes geometry

The precision comes from the fact that both benefits survive: low-frequency sound travels and penetrates walls, and the curve's shape is a two-parameter physical measurement rather than a single event.

🌈 The spectrum nobody looks at 1:06

Two clips are played: one contains the geolocating information, one does not. At normal playback they are indistinguishable, because the signal is inaudible. In a spectrogram — time on X, frequency on Y — it is still invisible at default zoom and resolution. Only when you zoom into the right band and raise the resolution does a thin descending-then-rising trace appear: a Doppler curve from a propeller aircraft.

The general lesson, before any physics: a recording is not the audio you can hear. It is a wideband measurement of everything the microphone was sensitive to, at a dynamic range your ears compress away. Any file that passed through a codec carried a lot more than the intended sound.

✈️ Step 1: narrow by flight 2:37

The prior art that makes this tractable is ADS-B: publicly broadcast aircraft position, altitude, velocity and identifiers, available through commercial APIs and through scraping. The author pulled every flight over the continental US on the target date — tens of gigabytes of parquet — and immediately cut it down.

  1. Propeller, not jet. Listen to the boosted clip and the aircraft type is obvious to the ear. ADS-B's type code field does not say "prop vs jet" directly, but ICAO type designators do — and since that lookup table is incomplete, he inverted the logic: filter out all known jet types rather than trying to whitelist props.
  2. Everything else is a candidate. The resulting map is still the whole country with a lot of lines on it.
Inverting the filter is the first reusable trick. When your allow-list is incomplete but your deny-list is known, filter by exclusion. It is the same reasoning as "all models are wrong but some are not useful": the cost of a false positive is more compute, the cost of a false negative is a failed search.

📐 Step 2: CPA and the delayed CPA 4:31

Terminology, first — and one correction: the video calls CPA the "closest point of arrival". The standard term is closest point of approach.

CPA matters because "hearing a plane" is not an instant. A flyover's Doppler curve lasts close to two minutes, so the usable timestamp is the CPA time — the moment the aircraft was closest, when the curve crosses its fundamental and is loudest.

Then two physical corrections turn a rough idea into arithmetic:

CorrectionWhy
Delayed CPASound takes time to travel. The listener hears the CPA later than it happened — seconds later at kilometres of range. For a point 3+ km away, the example goes from a CPA of 22:46:36 to a delayed CPA of 22:46:46.
Slant distanceAircraft altitude is above sea level, not above the ground. To get the true straight-line distance you need terrain elevation at each candidate point — which means a digital elevation model (DEM), not just a flat map.

Now lay a 200 m grid over the search area — he uses a generous 10 km radius around each flight, because beyond that you would not hear an aircraft even in ideal conditions — and for every grid point record the delayed CPA time for that flight. Do it for all flights and each point holds a list: at these times, you would have heard a plane.

⏱ Step 3: the 920-second offset 7:04

The recording contains two flyovers. Take the offset between their CPA times — about 920 seconds — and keep only the points that heard a plane and then, 920 seconds later, heard another.

Note the honest treatment of error: where exactly you measure the offset from varies by a few seconds, so the filter allows a window rather than an exact match. That kind of small, declared tolerance is the difference between a filter that works and one that eliminates the true answer.

FilterCandidatesNote
Time offset only, small test area~35,000That area is under 0.05% of the continental US
+ velocity and CPA-distance bounds~73,000Clustered around airports — which is a clue in itself
+ silence filter~15,000Still far too many to model
His aside on scale is worth checking, and it survives. Divide the continental US into American football fields laid end to end: about 1.5 billion fields, roughly 1.66 × 10⁸ km of length — about 4,100 times around the Earth, or some 215 round trips to the Moon. He says "almost 200 times", which is the same claim measured against the round trip. The number is a joke, but the arithmetic holds.

🎚 Step 4: the curve is a fingerprint 8:28

Two clips, one audibly faster. That intuition is the whole physics: a constant-velocity flyover produces a Doppler curve with exactly two parameters.

ParameterWhat it controls in the curve
Aircraft velocityThe total frequency drop — how large the excursion is
CPA distanceHow quickly the drop happens — the sharpness of the transition

So instead of filtering for "heard a plane, then 920 s later heard another", you filter for "heard a plane at this speed from this distance, then 920 s later heard another at that speed from that distance". Those two parameters collapse a hundred thousand candidates into tens of thousands.

Sanity check on the numbers: for a source at 130 Hz moving at 100 m/s, the Doppler formula f = f₀·c/(c + v_r) predicts the received frequency falling to about 101 Hz as it recedes — a drop of roughly 30 Hz over the flyover, which is exactly the scale of the traces in the spectrogram.

The clue that pays off later: the curve on the right fits an ideal Doppler model beautifully; the left side does not fit well. He deliberately widens the velocity range to avoid filtering out the true flight. The misfit is not noise — it is the aircraft changing heading, speed or altitude, and it becomes the final discriminator at the end.

🔇 Absence is also signal 11:36

Most of the remaining candidates cluster around airports — because that is where aircraft are. But the recording contains almost 15 minutes of no Doppler curve between the two events, and you do not get silence like that next to a major airport.

"If you're near an airport, you hear a lot of flights and you get a lot of signal. If you're not, then the silence itself is also a signal. It really works anywhere on that spectrum."
This is the single most transferable idea in the video. Most location-finding work chases features. The absence of features — no flyover for fifteen minutes, no echo, no hum — is information with exactly the same standing, and it is usually the thing nobody encodes because it is not on screen. Negative evidence is cheap to compute here because the ADS-B data already tells you what should have been audible.

🎯 Step 5: the mistake that breaks everything 14:15

Fifteen thousand candidates still meet every constraint, and the spectrogram has been squeezed dry. The next step is deeper: instead of reconstructing a flight path from a curve, model the exact curve each candidate flight geometry would have produced, then score observed against modelled.

Modelling is straightforward in principle. The Doppler curve is a function of the aircraft's radial velocity — how fast it moves directly toward or away from you. Head on, radial equals true velocity; directly overhead, radial is zero and there is no shift. Sample the flight data at successive times, compute radial velocity, push it through the Doppler equation, plot the resulting frequency.

And here is the trap, which he pauses on deliberately:

"The frequency heard by the observer at 7:12:30 is not based on the plane's radial velocity at 7:12:30. It's based on the plane's velocity when it produced the sound that we then hear at 7:12:30."

Naively, you would compute frequency from the aircraft's state at emission time minus nothing, or you would compute the correct curve and then delay it. Both are wrong in the same way, and he demonstrates why: shifting the correct curve to line up one point makes the rest diverge badly. It is not the same curve, late — it is a different curve.

The general form of that bug: whenever a measurement travels at finite speed, the quantity you observe now belongs to the state of the source then. Mixing the emission time and the reception time in one equation is the classic light-time correction error, and it appears everywhere from astronomy to GPS to this. A search built on the wrong curve does not return a near miss — it returns nothing, which is why the error is dangerous: it looks like a failed hypothesis rather than a bug.

🧮 Step 6: locked scoring, 100 m grid 18:18

Scoring is simple to state: overlay the modelled curve on the observed spectrogram and sum the brightness it covers. Two sources of error need handling, because both the fundamental frequency and the CPA time were measured by eye from the curve.

EventHow it is scored
Event 1Place the modelled curve at the measured CPA timestamp, then sweep a few seconds of time offset and a range of fundamentals, and take the best combination
Event 2Sweep the fundamental only. Its temporal placement is fixed by flight geometry, so if it lands at the wrong offset after event 1 is aligned, that is genuine evidence against the candidate

That asymmetry is the clever part: correct the measurement error once, then let the physics carry the second event. The 920-second offset becomes a hard physical constraint rather than a free parameter that could be tuned into existence.

Why the grid had to get finer: at 200 m, a candidate can sit up to ~141 m from the true point and score badly — the method is precise enough to punish its own coarse grid. Refining to 100 m expands 15,000 candidates to 30,000–40,000, each requiring a modelled pair of curves. That is why every earlier filter mattered: the full-US, full-day search is computationally out of reach.

🎬 One minute, unknown place 22:47

The first search resolved by ranking: score each candidate on both events, group by flight pair, keep the best point per pair. One point stands out at 20.48, with the runner-up around 15 — and the gap is visible in the spectrograms, not just the numbers. First place covers the observed curve almost exactly; second place misses the top of event one and is plainly wrong on event two.

Then the harder demonstration, and the one that should worry anyone who publishes raw audio:

GivenConstraintResult
Two flyovers, unknown place, unknown time920 s offsetOne clear winner
One single minute of audio, known timestamp, US-wideNone on locationSame location, first place by a wide margin

Two entirely different methodologies — two events and no clock, versus one event and a clock — put the same point first. The trade-off he draws out is the useful rule: you need one of the two constraints to be good. A city is about 0.01% of the land area, and constraining space that tightly lets you relax time completely; you may not need the minute, the hour, or even the day.

"We got the location of that recording within a couple hundred feet from one minute of audio where you cannot hear the plane."

🏞 The reveal 25:33

Back to the map: the winning coordinate lands on a shoreline. With flight IDs known, he re-scores at much finer resolution around each flight path, producing heat maps per event whose intersection is a small patch of bank. Then street view: find the V-shaped tree, the point beside it, the rounded mass after it — and, at the top of a pole, the security camera that recorded the clip.

This article deliberately omits the coordinates. The video shows them, and the demonstration's point is precisely that it can. But a published article that pairs a private camera's position with a method to derive it converts a warning into a targeting aid, which is a materially different act. The warning is the value; the address is not.

🛡 Defences, and why the obvious ones fail 26:09

The last third is the part to actually act on, and it is a sequence of intuitive defences being demolished on camera.

DefenceResultWhy
High-pass filter to cut the low frequenciesFails twiceThe curves sit in roughly the same band as the human voice — you would remove what you want to keep. And after exporting to MP3 and boosting the remaining bands, the curve returns
Drown it out with foreground noiseFailsA speaker across the room playing a Doppler curve is still measurable under speech — he demonstrates this live
Phone compression and noise reductionFailsRouting the curve through a real phone call — with the strong signal muted so only the phone's output is audible — the curve survives and even leaves a visible gap when it stops
Cutting the audioPartially worksRemoving the segment destroys the two-event offset. But if you keep a single minute and the location search space is large, you then need a precise recording time
Additional noise cancellationPractical, untestedHis suggestion, not a demonstrated result
The uncomfortable conclusion about codecs: compression removes what you can hear, not what is measurable. A low-level, structurally coherent signal survives codecs that are designed around perceptual masking — because masking is a property of ears, and the attack uses a spectrogram. Anything that ships raw or lightly compressed audio from a location worth knowing is shipping a locator.

⚖️ The honest threat model 28:09

He explicitly refuses to fearmonger, and the caveats are the most important lines in the video:

  • The odds are slim. Few people can do this and fewer will.
  • There are a hundred easier ways to find you than fitting Doppler curves to aircraft telemetry.
  • The entry cost is real: months of work, thousands of lines of code, tens of gigabytes of parquet, 3D physics, country-scale elevation models.
  • But the plausible use case is not casual. A recording with literally zero visual clues — footage from an investigation, a human video online, a random security camera — becomes locatable.
"I'm not trying to fearmonger with this video... In reality, there's probably a hundred easier ways to find you than this."

🧠 What generalises beyond this 29:05

Strip away the aircraft and this is a template for any physical-inference search:

  1. Fuse a public dataset with a raw sensor side channel. ADS-B is public; the audio is yours; the intersection is a location.
  2. Filter in order of cheapness. Type, then time offset, then shape, then full modelling — each stage exists so the next one is affordable.
  3. Treat absence as evidence. Silence between events eliminated more candidates than the events themselves.
  4. Model forward, don't invert backward. Reconstructing geometry from a curve is ambiguous; modelling a curve from known geometry is not.
  5. Lock what physics fixes, sweep what you measured. Correct the measurement error once, then hold the derived constraint rigid.
  6. Respect propagation delay. The state you observe now is the state at emission.
  7. Publish the method, withhold the tooling. A rare and, here, defensible choice: the awareness travels, the capability does not.
And the uncomfortable meta-point for anyone who publishes media: you are not publishing what you chose to publish. You are publishing a high-dynamic-range physical measurement plus metadata plus timing, and the set of side channels that can be extracted from it grows as compute gets cheaper. Geolocation is now a question of what else is in the file, not whether the file shows where you were.

✅ Claims checked

ClaimVerdictEvidence
ADS-B provides public aircraft position, altitude and velocityCorrectPublic broadcast; commercial APIs and scraping both viable, as described
Doppler curve shape depends only on velocity and CPA distance (constant velocity)CorrectStandard result for a moving source: f = f₀·c/(c + v_r)
Slant distance requires terrain elevation, i.e. a DEMCorrectAircraft altitude is above sea level, not above ground
CPA stands for "closest point of arrival"CorrectionStandard term is closest point of approach
Thunder geolocation gave ~5 km precisionHis own earlier resultConsistent with his previous work; not independently verified here
Long-wave audio penetrates walls and survives codecsDemonstrated in-videoHigh-pass removal, loud foreground, and a live phone call all failed to destroy the curve
Filter counts: ~35,000 → ~73,000 → ~15,000 → 30,000–40,000 after refinementHis reported figuresStated on screen per stage; not reproducible without his tooling, which is not released
One minute of audio located the site within a couple hundred feetHis reported resultSame location ranked first under two independent methodologies
Football-field arithmetic: continental US end-to-end wraps the Earth and reaches the Moon and back ~200 timesChecks out≈1.51 × 10⁹ fields × 109.7 m ≈ 1.66 × 10⁸ km ≈ 4,100 Earth circumferences ≈ 215 Moon round trips
Phone compression "surely" destroys such signalsDisproved on cameraThe curve survives a real call and pauses where the source was muted
High-pass filtering removes the informationDisproved on cameraExport to MP3 and re-boost restores the curve
No code or tools releasedStated by the authorVideo description: "No code or tools are being released"

Basis note. Built from the full 29:12 transcript. The physics, the terminology and the filter chain are checked against standard results; the pipeline's performance is the author's own reported result and is not independently reproducible, since the tooling is withheld. Two of the video's own intuitions (high-pass filters, phone compression) are disproved by its own demonstrations. The located coordinates are intentionally omitted.

🔑 Key takeaways

  • The audio contains more than the sound. A spectrogram of an ordinary recording can hold a location fingerprint that no one in the room could hear.
  • Two parameters, one fingerprint. For a constant-velocity flyover, velocity sets the size of the frequency drop and CPA distance sets how fast it happens — enough to locate a listener to tens of metres.
  • Public dataset + private sensor = location. ADS-B telemetry is free; the recording is the only piece the attacker needs.
  • Silence is signal. Fifteen minutes without a flyover eliminated candidates that every positive feature had kept alive.
  • Invert the incomplete list. When a lookup table is missing entries, filtering out the known-bad beats whitelisting the known-good.
  • Propagation delay is not a shift. The frequency you hear now belongs to the source's state when it emitted — model forward from emission time or the whole search silently fails.
  • Lock what physics fixes; sweep what you measured. Correct measurement error once, then let the derived constraint between two events stay rigid.
  • Negative evidence deserves the same standing as positive evidence — and it is usually the thing nobody encodes.
  • High-pass filters do not save you; the curves sit in the vocal band, and re-boosting the surviving spectrum brings them back.
  • You cannot drown it out — a quiet, structurally coherent signal survives loud foreground audio and perceptual codecs.
  • Codecs remove what ears hear, not what instruments measure. Masking is a property of perception; the attack is a property of spectra.
  • Cutting audio helps only if you also stop needing the clock. One surviving minute plus a precise timestamp is a full search.
  • Constrain one axis well and the other can be free: know the city to 0.01% of the land area and you may not need the hour, the day, or the minute.
  • Publish the method, withhold the tooling. Awareness scales; capability should not.

🔗 Resources

  • The source video — colsto, "I discovered a sound that leaks your exact location (and it's everywhere)", 29:12, 2 November 2026
  • The full recording — the challenge footage, linked by the author
  • Background reading: ADS-B as a public data source, ICAO aircraft type designators, digital elevation models, and the Doppler equation for a moving source
Basis note and scope. Written for a technical audience, from the full transcript. No code, no thresholds beyond those stated on screen, and no coordinates: those are the three things that would turn a warning into a tool. The methodology is described at the level of the recording so that defenders can reason about what a recording contains — which is the entire practical purpose of the video.

⏱ Timestamp index

0:00The challenge: a date and "the continental US"
0:41Thunder gave 5 km; this gives metres
1:06Two clips, indistinguishable — into the spectrogram
2:37ADS-B, and filtering out jets by type code
4:31CPA, the delayed CPA, and why slant distance needs a DEM
7:04The 920-second offset filter
7:5035,000 candidates, and the football-field aside
8:28Velocity and CPA distance from curve shape
11:1873,000 points, clustered around airports
11:36The silence filter: 73,000 → 15,000
14:15Modelling the curve from real flight geometry
16:45The emission-time mistake
18:18Locked two-event scoring
20:12The 200 m grid is too coarse: refine to 100 m
21:03Scoring results: 20.48 against a field of ~15
22:47One minute of audio, known clock, US-wide
24:04Same point, two methodologies
25:33Street view, the tree line, and the camera
26:09Defences: high-pass fails, noise fails
27:13The curve survives a live phone call
28:09The honest threat model
29:05Closing: it was all background noise
☰ View all