A cyber-criminal on the run, a wingsuit jump between planes at 5,000 meters, and 24 million flight records to sift through. This is the most cinematic KDA case yet.
The problem
This is the abridged case description. Emphasis mine:
Thanks to your information, we finally managed to track down Krypto - turns out he held a high-ranking position as City Manager in the Mayor's office. He's also the mastermind behind the infamous Kuanda.org that you brilliantly exposed. However, he slipped through the fingers of Digitown's law enforcement. Given the new international nature of the case, we (the National Security Office) are taking over.
Our sources indicate that he was spotted at the Doha airport on August 11, 2023, between 03:30 AM and 05:30 AM (UTC). By the time our agents arrived, he had already made his escape, presumably utilizing a private jet. We have a single lead that suggests Krypto may have attempted a plane-to-plane jump, given his skills as a wingsuit expert.
A wingsuit jump. Between two planes. Mid-flight. Sure, why not.
And the main question:
In which city did the suspect land?
We get two tables: Flights with millions of rows of positional data (timestamp, callsign, coordinates, altitude, velocity) and Airports with tens of thousands of airports worldwide.
The Train Me section introduces geospatial functions for hashing locations into comparable cells and calculating distances between points.
The investigation
Finding the source planes
First things first - where exactly is Doha airport?
Airports
| where municipality == "Doha"
Hamad International Airport, lat 25.27, lon 51.61. Now let's find every plane that was on the ground there during Krypto's window.
The trick is using geo_point_to_s2cell() to hash both the airport's location and each flight's position into comparable S2 cells. Think of it as dividing the Earth's surface into a grid - two points in the same grid cell are nearby. S2 precision 11 gives us roughly 3km cells (see the S2 cell statistics), close enough for airport proximity.
let doha_lat = toscalar(Airports | where municipality == "Doha" | project lat);
let doha_lon = toscalar(Airports | where municipality == "Doha" | project lon);
let window_start = datetime(2023-08-11 03:30);
let window_end = datetime(2023-08-11 05:30);
let s2_precision = 11;
Flights
| where onground
| where Timestamp between (window_start .. window_end)
| extend key = geo_point_to_s2cell(lon, lat, s2_precision)
| where key == geo_point_to_s2cell(doha_lon, doha_lat, s2_precision)
| summarize min(Timestamp), max(Timestamp) by callsign
| order by min_Timestamp asc
19 planes were on the ground at Doha during the two-hour window. Krypto boarded one of them. Now we need to figure out which one, and more importantly - which plane did he jump to?
The mid-air rendezvous
A wingsuit jump requires two planes flying close together for several minutes, with the source plane above the target (you jump down, not up). If we find a Doha plane that was directly above another plane mid-flight, that's our jump.
The approach: for each source plane (after it left Doha and was airborne), join against all other airborne planes. We use S2 cells again but at precision 13 (~1km) for tighter matching, filter for timestamps within 60 seconds, and require the source to be higher. An "encounter" is one such matching pair of position reports. Multiple encounters between the same two planes means they flew together for a sustained period, exactly what a wingsuit jump needs.
let doha_lat = toscalar(Airports | where municipality == "Doha" | project lat);
let doha_lon = toscalar(Airports | where municipality == "Doha" | project lon);
let window_start = datetime(2023-08-11 03:30);
let window_end = datetime(2023-08-11 05:30);
let s2_airport = 11;
let s2_air = 13;
let SourcePlanes =
Flights
| where onground
| where Timestamp between (window_start .. window_end)
| extend key = geo_point_to_s2cell(lon, lat, s2_airport)
| where key == geo_point_to_s2cell(doha_lon, doha_lat, s2_airport)
| distinct callsign;
Flights
| where callsign in (SourcePlanes)
| where not(onground)
| where Timestamp > window_start
| extend key = geo_point_to_s2cell(lon, lat, s2_air)
| join kind=inner (
Flights
| where not(onground)
| where Timestamp > window_start
| where callsign !in (SourcePlanes)
| extend key = geo_point_to_s2cell(lon, lat, s2_air)
) on key
| where abs(datetime_diff('second', Timestamp, Timestamp1)) < 60
| where geoaltitude > geoaltitude1
| extend alt_diff = geoaltitude - geoaltitude1
| summarize
encounters = count()
, min_alt_diff = round(min(alt_diff))
, max_alt_diff = round(max(alt_diff))
by source = callsign, target = callsign1
| where encounters >= 3
| order by encounters desc
What are we looking for in these results? A real wingsuit jump means significant altitude difference (hundreds of meters, not taxiing altitude) and multiple encounters sustained over several minutes. The encounter count alone isn't enough.
The false positive
GGJN222 and FLME566 had 649 encounters, way more than anything else. That looks like our wingsuit jump, right?
Not so fast. Look at the altitude difference: 8 meters. Both planes were flying at roughly 100 meters above ground. That's not a wingsuit jump, that's two planes taxiing or doing low-altitude maneuvers near an airport. High encounter counts don't mean high-altitude encounters. Always check the absolute values.
The real jump
OJIT393 and HFID97 tell a very different story: 25 encounters with altitude differences between 573 and 1,102 meters. That's wingsuit territory.
Let's zoom in on this encounter:
let s2_air = 13;
Flights
| where callsign == "OJIT393"
| where not(onground)
| extend key = geo_point_to_s2cell(lon, lat, s2_air)
| join kind=inner (
Flights
| where callsign == "HFID97"
| where not(onground)
| extend key = geo_point_to_s2cell(lon, lat, s2_air)
) on key
| where abs(datetime_diff('second', Timestamp, Timestamp1)) < 60
| project
Timestamp,
src_alt = round(geoaltitude),
dst_alt = round(geoaltitude1),
alt_diff = round(geoaltitude - geoaltitude1),
distance_m = round(geo_distance_2points(lon, lat, lon1, lat1))
| order by Timestamp asc
From 11:43 to 11:47 UTC - about four minutes - these two planes flew in perfect vertical alignment. OJIT393 at roughly 5,500 meters, HFID97 at roughly 4,500 meters. One thousand meters of altitude difference, zero meters of horizontal distance. That's your wingsuit window.
The coordinates place this somewhere over northwest England.
The solution
Now we just need to follow the destination plane to its landing.
let s2_precision = 11;
Flights
| where callsign == "HFID97"
| where onground
| summarize (LandingTime, LandingLon, LandingLat) = arg_max(Timestamp, lon, lat) by callsign
| extend key = geo_point_to_s2cell(LandingLon, LandingLat, s2_precision)
| lookup (Airports | extend key = geo_point_to_s2cell(lon, lat, s2_precision)) on key
| project callsign, LandingTime, Name, municipality, iso_country
Barcelona. Krypto landed at Josep Tarradellas Barcelona-El Prat Airport at 13:59 UTC.
The full escape route: Krypto boarded a plane at Doha heading for Dublin. Over northwest England, he wingsuit-jumped 1,000 meters down to a plane heading south to Barcelona. The Dublin flight continued on its way with one fewer passenger, and Krypto slipped off into the Mediterranean sun.
For the curious - the source plane (OJIT393) landed in Dublin at 12:42 UTC, completely unaware that it had just been part of the most dramatic airplane exit since D.B. Cooper. Another badge earned, another cyber-criminal tracked down. Well, located at least. Catching him is someone else's problem.
Thank you for reading