# Scenario 06 — Drone Swarm from Ship

> **Synthetic demo data only. Not based on real observations.**

## Story

MV POHJANTUULI (MMSI 230991601, gray-zone utility/research vessel) transits the Gulf of Finland westbound on 2025-06-12. At 09:25 UTC the ship holds position ~22 km south of Kilpilahti in open water. Three minutes before launch, the AIS transponder is switched off. At 09:33 UTC, **six small drones** (DJI-class, RCS ~0.025 m²) lift off simultaneously and fan out toward three groups of Finnish coastal targets:

| Drone | Target | Range |
|-------|--------|-------|
| T-DRN-SW-01 | Kilpilahti refinery (N) | ~42 km |
| T-DRN-SW-02 | Kilpilahti (NE) | ~41 km |
| T-DRN-SW-03 | Porvoo harbor (W) | ~34 km |
| T-DRN-SW-04 | Porvoo harbor (E) | ~33 km |
| T-DRN-SW-05 | Sipoo coast (W) | ~25 km |
| T-DRN-SW-06 | Sipoo coast (NW) | ~24 km |

The drones do **not** return — expendable one-way profile.

## Data streams

| File | Format | Notes |
|------|--------|-------|
| `realtime/ais.ndjson` | AIS NDJSON | POHJANTUULI + ~800 ambient ships; 3 s cadence |
| `realtime/ais_snapshot.geojson` | GeoJSON | Position snapshot at SWARM_LAUNCH |
| `realtime/drone_radar.ndjson` | Drone radar NDJSON | 6 swarm tracks + patrol drone |
| `realtime/plane_radar.ndjson` | Radar NDJSON | Surface track of mother ship with mmsi_hint |
| `realtime/mac.ndjson` | MAC NDJSON | 6 drone MACs + background |
| `realtime/mac.csv` | CSV | Verbatim sensor schema |
| `static/swarm_fan.geojson` | GeoJSON | Convex envelope of drone fan |
| `static/sensors_used.geojson` | GeoJSON | Relevant sensor placements |
| `historical/ais_baseline.ndjson` | AIS NDJSON | 6-day prior transit baseline |

## Fusion angles

- **AIS dark + simultaneous radar contacts** — correlate dark window onset with first radar hits
- **Fan geometry** — azimuth spread + diverging tracks point back to ship origin
- **MAC coastal arrival** — drone MACs on coastal sensors with no filed flight plan
- **No return flight** — one-way altitude profile flagged by patrol drone MAC-AIR-DRN-01

## Fabric demo queries

```kql
// Count simultaneous airborne contacts within 5-minute window
DroneRadar
| where swarm_id == "SW-2025-0612-01"
| summarize contacts=dcount(track_id) by bin(ingestion_time, 5m)
| where contacts > 3
```

## Analyst notes

The convergence of three signals — AIS dark window onset, simultaneous multi-track radar,
and uncorrelated DJI MACs on coastal sensors — within the same 7-minute window creates
a composite suspicion score of ~0.96. Cross-reference with `plane_radar.ndjson` surface
track for ship origin confirmation.