# S7 — Drone Swarm From Ship

## Scenario Summary
**Date:** 2025-05-21 · **Duration:** ~3.5 hours (07:30–11:00 UTC)  
**Classification:** HIGH THREAT — coordinated multi-drone swarm, critical infrastructure overflight

## Narrative
MV RASKAUS (MMSI 230777301), a previously unknown vessel with no Baltic port-of-call history, enters the Gulf of Finland from the south and anchors 25 km offshore. At 09:00 UTC it launches a coordinated swarm of **five DJI-class drones** in staggered 30-second intervals, each heading for a different Finnish coastal target:

| Drone | Target | Key event |
|-------|--------|-----------|
| D1 (5C:E2:8C:DD:EE:11) | Kilpilahti petrochemical | Unauthorised RPAS zone orbit |
| D2 (5C:E2:8C:DD:EE:12) | Vuosaari container port | Approach then RTB (possible diversion) |
| D3 (5C:E2:8C:DD:EE:13) | Estlink-1 cable corridor | 4-minute hover over cable ROW |
| D4 (5C:E2:8C:DD:EE:14) | Helsinki South Harbour | Harbour approach |
| D5 (5C:E2:8C:DD:EE:15) | Porvoo coast (eastern flank) | Overflight |

Coastal MAC sensors detect drone MACs sequentially as the swarm fans out. A Border Guard patrol drone (RAD-DRN-PAT-01) intercepts D1/D2 and captures the **smoking-gun co-observation**: D1 MAC and operator iPad MAC (A4:83:E7:5C:9B:55) simultaneously at RSSI > -62 dBm. All drones RTB at 09:50; RASKAUS departs south at 15 kn.

## Key Differences from S5
- **S5**: single reconnaissance drone, ship → Kilpilahti → ship  
- **S7**: 5-drone swarm, staggered launch, fan-out to 5 targets simultaneously, coordinated RTB

## Composite Score
0.91 — driven by swarm count (×5 unique airborne tracks from one vessel), cable-area dwell, no baseline history, and co-observation.

## Data Files
| File | Description |
|------|-------------|
| `data/realtime/ais.ndjson` | Full AIS stream (RASKAUS + ambient) |
| `data/realtime/ais_decimated.ndjson` | Downsampled AIS for browser |
| `data/realtime/ais_snapshot.geojson` | Last-known position per vessel |
| `data/realtime/drone_radar.ndjson` | Radar tracks for all 5 drones + patrol |
| `data/realtime/mac.ndjson` | MAC observations (crew + 5 drone MACs) |
| `data/realtime/mac.csv` | MAC sessions in CSV format |
| `data/static/sensors_used.geojson` | Active sensors for this scenario |
| `data/static/infrastructure_used.geojson` | Critical infrastructure featured |
| `data/historical/ais_baseline.ndjson` | 7-day baseline (no swarm precedent) |
| `data/historical/mac_baseline.ndjson` | 7-day MAC baseline |