Travel Tech: When flight trackers expose your secrets

A corporate jet making repeated trips between two company headquarters may tell outside investors something neither company has announced: executives could be negotiating a merger.

The meetings may be entirely confidential, but public tracking services record the aircraft. That means anyone who know what they are looking at and watch long enough can begin to assemble the clues. Now combine such flights with ship movements and port records – all publicly accessible – and a rival may learn far more about a business than press releases reveal.

Since aircraft must broadcast their identity and position and ships have to report their course and destination, highly revealing patterns may well become apparent over time.

This is the commercial warning underpinning a new technical brief from cybersecurity firm TrendAI, titled Rethinking the External Attack Surface: Managing the Growing Risk of Open Cyber-Physical Data.

The power of such information was demonstrated in the run-up to Operation Epic Fury, as the US named its war against Iran. A Chinese company claimed it had detected the military build-up before the first strikes on 28 February 2026 by watching aircraft and ship movements.

TrendAI researchers trace repeated automated requests for data from public radio receivers and ship trackers. The requests pass through residential devices and short-lived cloud servers, making mass collection look like ordinary household internet traffic. Some of those connections lead back to internet addresses already associated with suspicious activity.

The equipment needed to collect the data can cost as little as US$25. Thousands of volunteer-run receivers already feed tracking platforms around the world. AI can then compare feeds and find recurring patterns, cutting work that once took specialist analysts hours down to a few seconds.

Gareth Redelinghuys, country MD of TrendAI Sub-Saharan Africa, says the commercial exposure is part of everyday transport technology.

“South African airlines, airports, ports and logistics operators are already part of the same open picture our global research describes – and the risk here is commercial, not just a state-security concern.”

South Africans who use flight trackers already know how much detail can be obtained about an aircraft. The maritime equivalent makes possible a map filled with ships, including destinations and expected arrival times.

“OR Tambo and Cape Town International both appear on public flight-tracking platforms,” says Redelinghuys. “Durban and Cape Town’s port activity is already visible on public vessel trackers.”

Aircraft use a system called ADS-B to transmit their identity and location, helping pilots and air traffic services track flights. Ships use a similar system, known as AIS, to avoid collisions and make port operations more efficient.

“None of that is unusual, and most of it exists for good reason – collision avoidance, port efficiency, safety,” he says.

Aircraft information can be transmitted about once a second, according to the report. Ships may broadcast their position every two to 10 seconds, while destination and expected arrival details are typically sent every six minutes.

Accumulated over weeks or months and matched with other public records, such data can expose operations a company thought was private.

“Our research shows that this same open data, aggregated across enough sources, becomes a competitive intelligence problem,” says Redelinghuys.

For a transport operator, the information can reveal available capacity and operating patterns to competitors, and corporate aircraft may betray site visits.

“A sustained uptick in a company’s corporate jet movements is a visible signal of M&A talks before any announcement is made.”

Shipping data can be even more revealing because cargo movements connect a company to businesses on both sides of its operations.

“Container and port-call data can reconstruct a company’s supply chain in detail – including suppliers and customers it has never publicly disclosed.”

Most companies have no department responsible for monitoring this exposure. Cybersecurity teams concentrate on company systems and stolen information. Operations staff know where aircraft or cargo are moving, but may have little reason to consider how those movements look when gathered by an outsider.

The information will seldom appear in the organisation’s IT records because the organisation neither owns nor controls the source.

“For an airline, an airport operator or a logistics company, that’s a live, ongoing view into your own operations, capacity and deal activity that a competitor can build for free, because none of the underlying data is stolen, and nobody inside the organisation is watching for it.”

* Arthur Goldstuck is CEO of World Wide Worx, editor-in-chief of Gadget.co.za, editor of GadgetWings, and author of “The Hitchhiker’s Guide to AI – The African Edge”.