FAA UAS sightings · public records
—
A Counter-UAS Incident Atlas, built by Analytica
Skywatch is a single operator view of the drone-incident picture — and the analysis underneath it. It plots every UAS (drone) sighting in the FAA's public records against the US infrastructure that matters — military installations, federally restricted airspace, airports, power plants, and DoD seaports — frames it against notable incidents overseas, and then turns the raw record into decisions: where risk concentrates, where it's heading, and which places are running hot right now. All from public data, nothing classified.
Scrub a decade of activity (2016–present), watch it clustered near sensitive sites, rank the installations with the most nearby activity, and search the raw FAA narratives. The Insights dashboard goes deeper: a population-normalized county risk model, a 12-month hierarchical forecast, a back-tested "running hot" watch-list monitor, LLM-structured narratives you can query by incident type, per-installation dossiers, and a one-page set of key findings you can export as an 8-page PDF brief. Every figure is reproducible from public data — no login, no backend.
Turn layers on and off in the Layers panel; each item on the map is clickable for detail. The Analytics overlays add a per-county sighting-rate choropleth, statistically-significant space-time clusters, a running-hot county watchlist, and installation enrichment — and Insights (top bar) opens the full analytics dashboard behind them.
How Skywatch is built, and what it does and doesn't claim.
Skywatch is built from public records only. Everything below states what a number is, how it was computed, and — the part that matters most for this audience — what it does not establish. Where an analysis came back null, or where we published something and later withdrew it, that is recorded here too.
Every US sighting point is one drone report from the FAA UAS Sightings public records, released as quarterly files (the earliest, Feb–Mar 2016, is a two-month release). The records contain only date, state, city, and a free-text narrative — no coordinates, no altitude field, no severity field.
Everything about a sighting — when, where, how severe, what kind of encounter — is derived from those four columns. The map's other point layers are not sightings and come from elsewhere: installations, airports, power plants, seaports and restricted airspace are separate public datasets (section 6), and positions, population denominators, registrations and weather come from the sources listed in section 22. Nothing about an individual report is imported from outside the FAA record.
A record is a report, not a confirmed incursion. It means a pilot, controller, or member of the public called something in. Counts therefore move with how many drones fly and with how alert and willing to report people are; the two cannot be separated from this source. Treat every count, rate and forecast on this site as being about reporting.
Skywatch covers Feb 2016 – present. The FAA only keeps the most recent quarters posted, so earlier quarters (2016–2019) were recovered from the Internet Archive and merged in. Two spans are missing entirely, and both are the FAA's: Jul–Sep 2017, a quarter with no publicly released file, and Jan 2022 – May 2023, a 17-month publishing pause. Neither is an omission here — no source file exists for those 20 months. They are shaded on the timeline and shaded and labelled on the activity chart, so an empty stretch is never mistaken for a quiet one (on the 40px timeline strip the explanation is a hover tooltip rather than a printed label). Every rate and seasonal figure divides by covered days, so a calendar month the FAA happened to publish more often cannot look busier for that reason alone.
A third apparent gap, Jan–Mar 2020, was our own parsing defect, not an FAA omission: that quarter shipped with a typo in its date column header, so all 373 of its reports were dropped on import. They are now included, and two guards stop a repeat — column headers are matched with a small typo tolerance (logged when it fires), and a source file that yields no new records and no duplicates when it plainly contains rows now fails the build instead of being skipped. Records are also deduplicated on import, on date + coordinates + narrative. In the current file set no two releases cover the same quarter, and the 15 exact duplicates dropped are all repeated rows inside a single FAA file; the count is reported at build time.
The gap list is computed from the data, not hand-maintained: the chart shading, the timeline, and the exported brief all read that one field, and the build is rejected if the computed gaps disagree with the months actually present. The two spans named above are the current contents of that field.
Each sighting is placed at a centroid, with the precision recorded per point and shown in every popup. Only the first tier is US Census Gazetteer-derived; the other two are a curated alias table and a hard-coded state point:
Nothing is placed at a fabricated precise location. This is the single most important limitation on the map: a dot is a city, not a spot. Sub-city geography — which side of the field, which perimeter, which approach corridor — is not recoverable from this source, and nothing here should be read as if it were.
The third tier deserves its own warning. Those 459 reports sit at the geometric centre of an entire state because their city could not be resolved at all. They are honest about their own precision in the popup, but they are not locations in any useful sense, and they land wherever that state's centre happens to be — which may be hundreds of miles from the actual event, and may fall near an installation by pure accident. A further 22 records naming non-US states are dropped outright rather than placed.
Altitude, aircraft type, evasive action, near mid-air collision, drone count and the referenced airport are parsed from the narrative text. Two independent passes do this, and they are kept separate on purpose:
Deterministic parsing (regex). Altitude, NMAC wording, evasive action, pass distance and drone count come from documented pattern rules in the ingest code — reproducible byte-for-byte, no model involved. The airport a narrative names is resolved by trying the most reliable patterns first (the FAA-OPS header, then distance/bearing, facility, runway, and last the route), and every candidate is then distance-checked against where the sighting actually is, rejecting anything beyond 75 nm — and rejecting it outright if the distance cannot be computed at all, since an unverified airport is a wrong fact rather than a softer version of a missing one. That guardrail exists because three failure modes are real: a route is origin-to-destination, so a Boston departure once scored an airport ~2,340 nm away (2,700 statute miles); a city name can contain a code ("SAN JUAN" → SAN); and an ordinary English word can be one ("RWY 19 AND …" → AND, Anderson Regional).
The severity score is additive, documented, and has no model in it. Each signal the report itself contains adds a fixed amount, capped at 100: near mid-air collision +45, crew took evasive action +25, pass distance ≤100 ft +25 (≤500 ft +15, ≤1,000 ft +8), above the 400-ft ceiling +8, the narrative names an airport that resolves within 75 nm +10, drone following the aircraft +12, two or more drones +8. It is a transparent index for sorting and filtering, not a validated risk model — the weights are our editorial judgement about aviation-safety salience, not estimates fitted to outcomes, because this source contains no outcomes to fit to.
Structured extraction (LLM). A second pass sends each narrative to Anthropic Claude Haiku 4.5 under forced tool-use with every field declared as a closed enum, so the result is a structured tool call rather than free prose. The enum is advisory rather than enforced — the model does occasionally return an off-enum value or drop a field — so validity is guaranteed downstream instead, by snapping anything invalid or missing to "unknown". Results are cached by content hash and committed, so the published figures rebuild with no API calls and are byte-identical across runs. It is instructed to record only what the text states or clearly implies from standard FAA phrasing — reading "W BOUND AT 6,000 FEET" as cruise, or "3 O'CLOCK POSITION" as lateral. That is narrow inference from convention rather than invention, but it is more than pure transcription, and it is a prompt instruction rather than an enforced constraint.
The limitation to weigh: extraction accuracy has not been measured. There is no gold-standard annotation set and no held-out validation sample, so we can state that outputs are always well-formed and always auditable against the visible source text, but we cannot quote a precision or recall figure — and we would rather say so than imply a validation that does not exist. Every label stays checkable against the source text, but not side by side: the map popup shows the narrative with the rule-derived fields, while the query browser shows the extracted facets, so confirming one against the other takes a locate-and-open step rather than a glance. Coverage is 16,950 of 17,012 narratives (99.6%); of the 62 without extraction 1 is empty and 61 are full-length narratives simply not yet run through the extractor. All are carried as unclassified rather than guessed. Anything derived from these fields should be treated as a structured index into the narratives, not as adjudicated fact.
Three things are stripped from every published record before it ships: a caller's phone number, an email address, and an aircraft registration, replaced with [phone], [email] and [tail]. Redaction happens at build time and covers every published field, not only the narrative text — the fields parsed OUT of a narrative are derived from the redacted version, so a registration cannot survive by being lifted into one of them. The unredacted text is never served to a browser or reachable from the site. All three patterns are unit-tested in both directions — that real contact details are removed, and that the numbers legitimately filling these reports are not.
Registrations are included because an N-number resolves to a named registrant through the public FAA registry: for a privately-owned aircraft that is personally identifying, even though each individual report is public. The pattern is deliberately narrow, because the same shape is worn by things that carry no personal information and whose removal would wreck the report. N90 is the New York TRACON and appears 764 times; N68 and N30 are small-airport identifiers; N3829.65 is a latitude. Those are all preserved. 36 genuine registrations across 31 reports are redacted.
The boundary is worth stating exactly. Redaction covers what this site publishes and serves. The FAA's own quarterly spreadsheets are committed to the repository unmodified, because that is what lets a third party rebuild the record and check our numbers — so the original text still exists there, exactly as the FAA released it. We redact the derived, queryable, trivially-scrapable copy rather than restate the government's own publication. The source carries no names and no addresses.
654 military installations (HIFLD "USA Military Bases") and 917 large/medium US airports (OurAirports, public domain). The FAA no-drone zones layer is the FAA's National Security UAS Flight Restrictions — 2,257 federally designated no-drone areas over DoD sites, federal prisons, nuclear facilities, the border, and national landmarks. The Power plants layer adds 1,940 significant generating stations and all 67 nuclear plants (HIFLD). The Strategic seaports layer is the 18 DoD commercial strategic seaports (USDOT/BTS) — ports designated by SDDC/USTRANSCOM to move military force and materiel, sized by annual tonnage.
"Near a base" is the distance from a sighting's city centroid to the nearest military-installation boundary (HIFLD) — measured to the polygon rather than to a base's centre, which matters for installations the size of Fort Irwin or Edwards. It uses a local equirectangular approximation rather than a true great-circle calculation, which keeps a point-to-polygon test over every base cheap enough to run per sighting and costs at most ~0.4% at these ranges (about 24 m at the 10 nm threshold). Because sightings are city centroids, proximity is driven heavily by urban bases — Fort Hamilton sits in New York City, Fort McPherson in Atlanta, and a report from anywhere in those metros lands close to them by construction. The hotspots panel ranks proximity for an operator to judge; it does not assert intent, targeting, or a confirmed incursion. Section 13 is the attempt to test whether the pattern survives that confound.
The overseas layer is a curated, illustrative set of 30 well-known, publicly reported drone incidents (2017–2024) — Gatwick, Abqaiq, Moscow, Tower 22, the Red Sea, and others — each carrying a source attribution. It is not a comprehensive database; it exists to frame the US picture against notable overseas events, and is labelled "curated" throughout. The layer can be switched to live ACLED drone-strike data (build-time fetch with a free key); when configured it is labelled "live · ACLED." The Global installations layer is a companion — a hand-verified marquee set of ~60 major overseas military installations (the US network, key NATO/allied commands and eastern-flank bases, and the notable Russian and Chinese footprint), colored by operator. It is OSINT / illustrative, not an exhaustive order of battle, and — because the FAA sighting data is US-only — it is visual context only, used in none of the analytics.
Because sightings are city/metro centroids, the spatial-correlation analytics are computed on counties, never on points — that covers the choropleth, the regression, Moran's I, the space-time scan and the exposure test. Methods that would need a true incident location are deliberately absent rather than approximated: there is no kernel density over points and no sub-city hot-spotting anywhere in the stack.
Two honest exceptions to "never on points". Each report does carry a per-sighting distance to the nearest installation boundary — measured from its city centroid to the base polygon, zero if inside — and that field drives the map's proximity layer and the per-installation dossiers. It is perimeter-relative geometry, and it is only ever as good as the centroid it starts from. Units also vary by analytic: the regression pools the whole record over counties, the space-time scan runs county × month, the Hawkes test runs state × day, the hierarchical forecast state × month, and the live monitor and its back-test run at city/place × month — not county.
Two details that change how the results should be read. County boundaries are land-only, so a coastal city's centroid can land just outside them — San Francisco's sits 2.9 km offshore. 240 reports are assigned to the nearest county rather than dropped (205 in California, 20 in Maine, 13 in Texas), a median and maximum move of 2.9 km, capped at 25 km. They are in the county figures because they were moved there, and every brief says so. The cap and an eligibility rule both matter: only reports we actually located are snapped, because a state-precision record sits at the state's geometric centre — for Hawaii that is open ocean between islands, and for Guam it is 5,294 km from the nearest county in the file. Those 3 remaining reports are excluded from all county analytics. And where these methods say "county centroid" they mean the midpoint of the county's bounding box, not its polygon centroid; for long or crescent-shaped counties that point can sit outside the county itself, which slightly perturbs nearest-neighbour structure and distance-to-facility measurements. Population denominators are Census estimates over 3,215 matched counties. The vintage is mixed by necessity and recorded per county: 2023 for the 50 states and DC, and 2020 for Connecticut and Puerto Rico. Connecticut replaced its counties with nine planning regions in 2022, so the current vintage no longer publishes figures on the county geography every boundary file still uses, and Puerto Rico ships in a separate release absent from the county file. Both were silently missing until recently, which put Hartford and San Juan on the map as zero-rate.
A negative-binomial regression of county sighting counts on log population, major airports, excess density, registered drones per capita, military bases and power plants, over 3,215 counties. "Excess density" is not raw density: it is the residual of log density on log population — how much denser a county is than a typical county of its size — which keeps density from simply re-entering population a second time. Effects are reported as IRR per +1 SD holding the others fixed, alongside each term's naïve bivariate correlation so the population confound stays visible. The dispersion parameter is estimated from the data rather than assumed (α = 2.33) and standard errors are HC0 robust (sandwich); pseudo-R² 0.739, maximum VIF 1.68, so the terms are not collinear enough to destabilise each other.
The result an operator should weigh most: population dominates (IRR 6.43, 95% CI 5.61–7.36) and airports remain strong after it (1.49, 1.33–1.68), while military bases are indistinguishable from no effect once airports and population are controlled (IRR 1.02, 95% CI 0.92–1.13, p = 0.74) — despite a raw bivariate correlation of 0.31. Power plants likewise show nothing (0.98, p = 0.58). That is a real finding and it cuts against the intuitive reading of the map: at county resolution, drone reports are where people and air traffic are.
A gradient-boosted Poisson model (histogram GBM, depth 3, 600 rounds, learning rate 0.05, L2 1.0, early stopping) fits county counts from population, airports, bases, power plants and drones per capita, and TreeSHAP attributes each county's predicted volume to those features — which is what drives the "Drivers & risk" panel and the infrastructure-driven county list.
It is scored honestly and reported honestly: on the same 5-fold held-out splits, the boosted model reaches pseudo-R² 0.727 while a plain linear Poisson model reaches 0.821. The simpler model wins out of sample (the GBM's 0.790 in-sample is the gap between fit and generalisation). We say so rather than quoting the in-sample number, and that comparison is itself the finding: the drivers are close to log-linear, with no exotic interaction structure for a tree ensemble to exploit. The GBM is retained for attribution, not for prediction.
Global and local Moran's I (k-nearest weights on county bounding-box midpoints, permutation inference) test whether county sighting rates are spatially structured at all. They are, but weakly: I = 0.102 against 999 permutations. The reported p = 0.001 is that test's resolution floor, not a measured value — no permutation reached the observed I. The local statistic marks 157 hot-spot counties and no cold spots, outlined on the "Sighting rate by county" choropleth; those are per-county pseudo-p values with no correction for testing 3,215 counties at once, so treat the outlines as "worth a look," not as 134 established findings.
The space-time clusters layer runs a Kulldorff space-time permutation scan (case-only; expected = space marginal × time marginal ÷ N) over county × month cylinders up to 250 km and 6 months, with p-values from 199 Monte-Carlo permutations of the reporting dates. It flags where and when reporting spiked above its own expected background.
Two things to know before reading that layer. It deliberately publishes down to p ≤ 0.2, not 0.05 — of the 12 windows shipped, 8 clear p < 0.05 and the weakest three sit at p ≈ 0.11–0.12. That is a screening threshold chosen so an analyst sees near-misses too, and each cluster carries its own p on the map. And the circle you see is a drawn approximation, not the cluster: a cluster is a set of whole counties, rendered as the circle that covers them. A cluster is a reporting anomaly worth an analyst's attention — not a located incursion, and not evidence of coordination.
This asks whether reports concentrate near installations beyond what the surrounding population explains. It is a county-level test, not a per-sighting one: each of 3,217 counties is measured from its centroid to the nearest facility, and a county is "within d nm" as a whole unit. So "share of sightings within 5 nm" means the share falling in counties whose centroid is that close — deliberately coarser than the map's own per-sighting distance field (section 7), which measures each sighting's city centroid to the nearest base polygon boundary. The two numbers are not interchangeable. This analysis uses 17,009 of the 17,012 reports (99.98%); the 3 excluded sit at a state centroid with no county to assign.
The comparison is only as good as its null, and the first null here was invalid. County counts are ~122× overdispersed relative to multinomial in variance, which makes a multinomial null about 11× too narrow in the units that matter — under it, essentially any facility set looks significant. Significance is therefore measured against population-matched placebo facility sets: 499 pseudo-facility sets of the same size, drawn from county centroids with probability proportional to population, with the report distribution held exactly fixed so only the facilities move.
For the 654 military installations at 5 nm, the raw enrichment is 2.19× (4,214 reports against 1,926 predicted by population), but placebo facilities score 1.37× on their own simply by sitting where people are — so the excess over placebo is 1.59×, not 2.19×. No placebo set in 499 draws reached the observed value, which is as strong as this design can resolve: the reported p = 0.002 is the floor of a 499-replication permutation test, i.e. p ≤ 0.002, not a measured 0.002. Deleting any single county from the ring leaves the raw enrichment at worst 1.93× — that is the 2.19× figure stress-tested, not the 1.59× excess. Excess over placebo falls steadily with distance — 1.16× at 10 nm, 1.07× at 25 nm, 1.02× at 50 nm — and the full 2–80 nm curve is drawn against the placebo envelope rather than a flat line. (The raw enrichment curve is not perfectly monotonic point to point; the threshold figures are.)
Four limits belong with that number, and they matter more than the number does.
The Installation enrichment layer disaggregates the same idea per base, against the same population-predicted baseline, for installations with at least 10 nearby reports. Read its counts carefully: a base is credited with reports from counties whose nearest base it is and whose centroid lies within 25 nm — not with every report within 25 nm. Where installations cluster, they divide the surrounding counties between them rather than each claiming all of them, so a single base's number is not comparable to a radius query. Per-base figures rest on far smaller counts than the aggregate and carry no significance test at all — they are for ranking and triage, not inference. The per-installation dossiers cover 143 installations at the same 25 nm radius with a 12-report minimum, but they group reports by each sighting's own nearest-base distance rather than by county assignment, so their counts are not the same quantity as the enrichment layer's.
A natural question for this audience is whether reports trigger further reports — a copycat or probing cascade. We tested it with a Hawkes self-exciting point process over 53 states × 3,195 covered days, in which a state's daily intensity is its own baseline plus an exponentially-decaying echo of that state's own recent counts (half-life selected from 1–21 days, kernel truncated at 60 days). All 17,012 reports are used. The effect size is the branching ratio: the expected number of follow-on reports triggered per report.
The answer turns entirely on how much seasonal freedom the baseline is given, so we publish the whole ladder rather than the most flattering rung. Against a coarse baseline — state × year, with one national seasonal shape imposed on all 53 states (530 parameters) — the model finds a branching ratio of 0.119 at overwhelming significance (p ≈ 3×10⁻²⁸). Let each state × year carry its own quarterly shape (1,908 parameters) and it collapses to 0.0014 (p = 0.79). At the strictest rung, state × year × month (5,565 parameters), it is exactly zero (p ≈ 1.00).
The mechanism is identifiable, which is why we regard the first rung as an artifact rather than a competing result: the excitation term is a weighted sum of a state's own recent counts, making it an excellent proxy for "how busy this state is right now" — so any local seasonal swing the national profile cannot represent leaks into it and is reported as self-excitation.
The published figure is the middle rung (state × year × quarter), not the strictest — chosen so the baseline is realistic without being so saturated that it could absorb a genuine cascade. On that spec there is no detectable self-excitation, and we report a profile-likelihood upper bound of 0.012 rather than a point estimate, which is the honest form of a null: at most roughly 1 report in 80 could be a triggered follow-on, and plausibly none. An earlier version of this site reported the cascade as a finding. It was wrong, and it has been retracted.
What this does not settle: the test is temporal and state-aggregated, with no spatial kernel — the data carry no coordinates, so the only cascade this design could ever see is a day-to-week, same-state one. It says nothing about repeat calls about a single incident, echo within a day, cascades crossing state lines, or contagion at sub-state scale. It assumes Poisson arrivals with a fixed exponential kernel. And it is a statement about reporting, not about drone activity: it does not claim incursions are unclustered, only that the reporting process does not measurably amplify itself at the resolution this source can see.
The national forecast fits a Poisson GLM of the monthly count (month-of-year season + linear trend), then estimates overdispersion from the fit residuals by a moment estimator and draws negative-binomial 80% / 95% prediction intervals around the predicted mean, 12 months ahead. Being precise about that construction matters, because those bands carry observation noise only — they do not propagate uncertainty in the fitted coefficients, so the true intervals are somewhat wider than drawn, particularly at the far end of the horizon. It is fitted on the 105 months that exist; the 20 gap months are omitted, not imputed.
A change-point scan (penalized binary segmentation on the seasonally-adjusted level) runs only within calendar-contiguous data, so the FAA's publishing gaps cannot be flagged as false structural breaks. It finds one real break, around Feb 2024, where monthly reporting stepped down about 12% (164 → 145).
State forecasts are a separate model: empirical-Bayes partial pooling across 52 states (Guam is dropped for insufficient history), which shrinks small states toward the national pattern instead of either ignoring them or pretending they are the nation. That choice is validated rather than assumed — on a 12-month holdout it beats both alternatives on every accuracy score: Winkler interval score 5.91 vs 6.12 (no pooling) and 6.02 (complete pooling), MAE 1.395 vs 1.425 and 1.473, and MAE on small states 0.517 vs 0.538 and 0.525. It does not win on calibration, and we will not claim it does: all three settings over-cover badly — 80% intervals contain the truth 92–93% of the time, 95% intervals 98.7–98.9% — and no-pooling is marginally closer to nominal at 80%. Over-covering means the bands are too wide rather than too confident, which is the safer failure, but they are wider than a well-calibrated 80% band would be.
The two models are fitted differently and therefore report slightly different national trends — about −1.7%/year from the national GLM and −1.2%/year from the hierarchical model, where the national trend is a shared parameter estimated jointly with each state's shrunken deviation from it — not an average of the state trends. Neither is more "correct"; the gap is the size of the modelling choice, and it is small next to the prediction bands.
A third, simpler detector rides alongside: the County watchlist flags recent county-months running at ≥2× their expected share of national activity with at least 6 reports, capped at the top 15. It is a screening list applied across roughly 800 counties × 6 months with no multiple-comparison correction — a queue to look at, not a set of findings.
All of these forecast reported sightings — a function of drones flown and public reporting — not incursions, and a single month can plausibly land anywhere inside the band.
Sightings are joined to daily ERA5 reanalysis (Open-Meteo) at the metro level — 176 metros, covering 13,489 reports (79.3% of the record) — and each report's day is expressed as a standardized anomaly against that metro's own seasonal climatology, so "drones fly in summer" cannot masquerade as a weather effect.
Reports fall on days that are calmer than normal (mean wind anomaly −0.13 SD), sunnier than normal (+0.29 SD) and marginally warmer (+0.10 SD); 66.2% land on dry days against a 56.4% baseline. The intervals are tight (±0.01–0.02 SD) because n is large, so these are precisely estimated but small effects. Read it as flying-conditions confirmation — consistent with recreational operation, and useful for anticipating busy days — not as a predictive model, and not as evidence about intent.
Non-negative matrix factorisation over the TF-IDF of 17,011 narratives groups them into 8 recurring archetypes — loitering and general sightings, approach/departure near a runway, short final and landing, a quadcopter identified up close, crossing at the aircraft's own altitude, near an airport with police notified, passing close off the wing, and law-enforcement response. Labels are generated from each topic's own top terms, so they describe the cluster rather than a category we decided in advance.
Before modelling, all geography is stripped from the text — every state name, every city token appearing in the data, and every airport IATA/ICAO code and municipality — so archetypes form on behaviour rather than re-discovering that Los Angeles reports mention Los Angeles. The "◆ unusual" reports are the 12 with the highest NMF reconstruction error — the narratives the 8 archetypes explain worst — restricted to content-rich reports (≥10 distinct terms) so that terse one-liners with little to model do not crowd out genuinely atypical language.
Two honest caveats. K = 8 is a fixed editorial choice, not a selected value — it was not chosen by a stability or coherence criterion, and a different K would give a different set of archetypes. And archetypes are a descriptive summary of language, not a threat taxonomy: they cluster how people write reports, which is correlated with — but not the same as — what happened. Where a headline figure sums archetype shares (for example the share of narratives describing an aircraft-conflict geometry), it is summing topics whose label matches conflict wording, not classifying each report individually — a coarser operation than it may appear.
The Live monitor simulates a watch floor standing at the last data date. For each place, expected recent volume is its long-run share of all reports × the national recent total — so the national seasonal ramp is already priced in, and an alert means more than this place's usual share of currently-high activity, not merely "summer." A place is flagged when it exceeds the negative-binomial upper bound of that expectation, with at least 4 reports in the 3-month window and at least 1.8× its expected share. Be clear about which of those does the work: at the small expectations typical of a thin-history place the NB bound sits at only one or two reports and is cleared easily, so it is the flat 4-report floor — not the statistical bound — that keeps rarely-reporting places out of the list. Each alert carries its dominant narrative archetype, severity mix, nearest installation, momentum, and the specific reports driving it.
An alert is a claim, so it is measured rather than asserted. A walk-forward back-test runs the identical rule at each of 82 as-of months (Feb 2017 – Mar 2026), trained strictly on data at or before that month — shares, dispersion and thresholds included — then scored on the next 3 months it never saw. As-of months whose windows straddle a publishing gap are skipped.
The honest headline is 2.0×. Alerts hit 5.8% of the time against a 2.9% base rate among the places that were actually eligible to be alerted (about 31 candidates per month), and beat a "just watch the busiest places" rival by 1.79×. Measured against all ~1,105 places instead, the same performance reads as 16.0× — which is the flattering framing, and it is wrong, because the monitor never had the option of alerting most of those places. An earlier version of this site published the all-places number as the headline. It has been corrected to the candidate-pool figure. A 1.9× edge on a 3-month horizon is a real but modest triage aid, and that is how it should be procured.
It is a simulation on historical data, not a live alerting service, and it forecasts reporting, not incursions.
Every analytic file ships with a provenance stamp — the script that wrote it, when it ran, the record count and date range, and a digest of the snapshot it was built from. The digest is the load-bearing part: counts and timestamps can coincide, but it changes if any record's date, state or city changed, so two figures carrying the same digest are provably built from the same records in the same order rather than merely produced at the same time. It is deliberately scoped to those three fields — the join keys and the geography — so it detects the failure that actually bites, a re-sort that shifts every id and silently re-attaches derived fields to the wrong incidents. It does not cover narrative text or parsed fields; a narrative-only change would leave it unmoved, and the separate alignment fingerprint on the narrative artifacts covers that join.
The build refuses to ship a set whose stamps disagree, which is what makes the numbers on this site mutually consistent instead of a collection of separately-plausible results. The current vintage is printed in the exported brief, so a printed page can be traced back to a specific dataset.
On the reproducibility half: the analytics stack is version-pinned in requirements.txt to the exact releases that produced the committed artifacts, all model seeds are fixed, and the LLM extraction cache is committed — so a rebuild needs no API key and cannot drift with model updates.
What a clone can actually reproduce, precisely: everything derived from the sighting record itself — the Hawkes test, both forecasts, the monitor and its back-test, and the narrative archetypes — rebuilds from the repository and returns the same numbers. The county-level analytics are not fully self-contained: the regression, choropleth, risk model, space-time scan and exposure test read county boundary and population files that are too large to commit and are excluded from the repository. Their outputs are committed and stamped, but reproducing them from scratch means re-fetching those Census inputs first. We would rather state that than let "fully reproducible" cover a gap an evaluator would hit on the first try.
An integrity gate runs locally and in CI before every deploy, and a violation fails the build rather than producing a warning. It asserts that record ids still line up with the narrative and archetype files they join to (a timezone bug once re-sorted the file and shifted every id after it, silently attaching archetypes to the wrong incidents — that is what this exists to catch); that disclosed gaps match the months actually present; that every artifact carries a provenance stamp and that all of them agree; and that the extraction cache still covers the narratives the published facets were built from. Ingest additionally refuses a source file that yields no new records when it should have, so a schema change can never again be absorbed silently. A 176-case test suite covers date parsing under multiple timezones, narrative parsing, PII redaction in both directions, artifact invariants, and accessibility requirements. The integrity gate itself is tested the same way: a synthetic corpus is corrupted 21 different ways — a shifted id, an unsorted date, an edited narrative, a dropped enrichment, a stale layer count — and each one must be caught. A gate that has only ever been run against good data has not been shown to work, and three of these were found failing in the wrong direction that way.
Findings that were published here and later failed re-examination are listed rather than quietly deleted, because how an analysis behaves when it is wrong is part of what you are evaluating.
Static and client-side — no backend, no login. Sources: FAA UAS sightings, FAA sUAS registrations and FAA National Security UAS Flight Restrictions; US Census county boundaries, gazetteer and population; HIFLD military installations and power plants; OurAirports; USDOT/BTS strategic seaports; NASA ASRS. Weather from Open-Meteo (CC BY 4.0), ERA5 reanalysis by Copernicus/ECMWF. Basemap © CARTO, data © OpenStreetMap contributors (ODbL) — shown on the map at all times. Narrative fields extracted with Anthropic Claude Haiku (extraction only, against a fixed schema; the source narrative is always shown alongside). The international layer is a curated set compiled from public news reporting — no ACLED data is redistributed. Full licensing and obligations: ATTRIBUTION.md in the repository.