Use Case · Counterintelligence & OPSEC
Dense mobile telemetry quietly exposes a sensitive site's operational cadence — and which devices are persistently present. Aurora™ filtered the noise to a short list of resident devices and surfaced foreign telemetry anomalies indicating location spoofing.
Commercially-available mobility data maps the rhythm of a sensitive site without ever crossing the fence line: who is persistently present, when activity peaks, and where staff and contractors come and go. In the wrong hands, that pattern is a counterintelligence and operational-security risk — site cadence reconstructed entirely from devices, no physical surveillance required.
Aurora applied a signal-to-noise funnel to the full body of location records across thousands of anonymized devices. Transient and low-recurrence traffic — drive-by, event, and delivery patterns — was filtered out tier by tier, isolating a small set of highly persistent, resident devices as the immediate priority for counterintelligence and operational-security screening.
Within the resident cohort, Aurora diagnosed a foreign-telemetry vector: devices that never physically left the site, yet whose data was routed through foreign servers via a compromised app, VPN, or commercial SDK — registering as a physical "ping" abroad. Distinguishing genuine physical movement from network artifacts is what separates a real anomaly from a false one.
The result is a prioritized, non-attributive shortlist for technical validation — with anomaly windows correlated against physical access patterns. The threat isn't foreign agents at the fence; it's domestic, trusted devices carrying aggressive ad-tech, foreign SDKs, or compromised apps into a sensitive zone, and bleeding location and network data to foreign infrastructure in real time.
Aurora™ is available to authorized government and security organizations. Access begins with a defined mission problem.
