Reading the Absence: What Missing Data Tells Intelligence Analysts

In 1943, the statistician Abraham Wald was asked by the US military to analyze bomber aircraft returning from missions over Europe. The military wanted to add armor to the planes but needed to know where. They showed Wald the bullet hole distribution on returning aircraft: heavy damage to the fuselage, light damage to the engines. The obvious conclusion was to armor the fuselage. Wald's actual recommendation was the opposite: armor the engines. The planes with engine damage weren't in the sample — they hadn't come back.

This is the foundational principle of absence analysis. The data you don't see is often more informative than the data you do. In open-source intelligence, this principle applies across every data layer — maritime, aviation, communications, environmental reporting, and social media. Learning to read the absence is what separates an analyst from a data viewer.

The Baseline: You Can't Detect Absence Without Normal

Absence is only meaningful relative to an expectation. If you don't know how many AIS-equipped vessels normally transit the Strait of Hormuz on a Tuesday, you can't detect that today's count is 40% below normal. If you don't know the typical flight density over eastern Poland, a sudden void means nothing to you.

Building baselines is the prerequisite for all absence detection. This means collecting data continuously, computing statistical distributions by time of day, day of week, and season, and establishing what "normal" looks like for every geographic cell and data type you monitor. In Deep Seer, we persist historical data to PostgreSQL and compute rolling baselines that allow the system to flag anomalous drops automatically.

The baseline must account for known patterns. Maritime traffic drops during monsoon season in the Indian Ocean. Flight density decreases on Christmas Day. AIS coverage is inherently sparser in the South Pacific than in the English Channel. These aren't absences — they're expected variations. The signal lives in the deviation from the pattern.

Traffic Disappearance Before Military Operations

One of the most reliable absence signals in geopolitical intelligence is the clearing of civilian traffic before military action. This pattern has been observed repeatedly in modern conflicts.

In the days before Russia's February 2022 invasion of Ukraine, commercial flight tracking data showed a progressive emptying of airspace over eastern Ukraine and Belarus. Airlines began rerouting flights away from the region. The NOTAMs (Notices to Air Missions) closing airspace were themselves signals, but the absence of normal traffic was visible in the data before the official NOTAMs were published, as airlines with better intelligence than the public began preemptively rerouting.

The same pattern appears in maritime data. Before naval exercises in the South China Sea, commercial shipping in the exercise area drops to near zero. Before the Houthi campaign against Red Sea shipping in late 2023, traffic through the Bab el-Mandeb strait showed a progressive decline as shipping companies rerouted around the Cape of Good Hope. The absence in the strait was visible weeks before the full-scale rerouting became front-page news.

AIS Blackouts and Naval Exercises

When a navy prepares for a major exercise, the exercise area becomes a void in AIS data. Warships that normally broadcast AIS during peacetime transits go dark. Commercial vessels are warned away by navigational warnings. The result is a geographic hole in the AIS map that corresponds precisely to the exercise boundaries.

Monitoring for the sudden appearance of these voids — areas where AIS contact density drops to zero in regions that normally show traffic — provides early warning of naval activity. The shape and size of the void can indicate the type of exercise: a long, narrow void along a coastline suggests amphibious rehearsals; a large rectangular void in open ocean suggests a carrier strike group exercise.

Flight Rerouting Around GPS Jamming Zones

GPS jamming and spoofing create another class of absence signals. When a state actor deploys GPS interference — as Russia has done extensively in the Baltic region, Kaliningrad corridor, and eastern Mediterranean — commercial aviation is directly affected. Pilots report GPS anomalies, and airlines respond by adjusting routes.

The resulting absence is visible as a deformation in normal flight paths. Routes that normally pass over a particular point begin curving around it. The density of flights in the jamming zone drops. The diversion itself traces the boundaries of the interference, effectively mapping the jammer's coverage area using commercial aircraft as inadvertent sensors.

During periods of heavy GPS interference near Kaliningrad, flight tracking data shows aircraft bound for destinations in the Baltic states taking paths that add 50-100 nautical miles to avoid the affected area. The cost in fuel and time is significant, which means airlines don't divert without reason. The absence of normal routing IS the evidence of interference.

Building an Absence Detection System

An effective absence detection system operates in four stages:

1. Grid the world. Divide your area of interest into geographic cells. The resolution depends on your data density — hexagonal grids (H3) at resolution 4 or 5 work well for maritime and aviation data, giving cells of roughly 1,000-5,000 square kilometers.

2. Build temporal baselines. For each cell, compute the expected number of contacts by hour of day and day of week, using at least 30 days of historical data. Store the mean and standard deviation.

3. Score current observations. Every hour (or more frequently for real-time systems), count the contacts in each cell and compute a z-score against the baseline. A z-score of -2 means the cell has significantly fewer contacts than expected. A z-score of -3 or below is a strong absence signal.

4. Cluster and alert. Individual cells with low z-scores might be noise. Multiple adjacent cells with simultaneously low z-scores form a spatial cluster that represents a geographic area where something has changed. These clusters are your absence alerts.

The challenge is false positive management. Weather diverts traffic. Holidays reduce flight counts. Seasonal fishing patterns shift fleets. Each of these must be modeled and excluded. The most effective approach is to maintain multiple baselines — one for the same day of week, one seasonal, one weather-adjusted — and alert only when all baselines agree that the absence is anomalous.

Real-World Examples from Recent Conflicts

Ukraine: The Kherson Withdrawal

In October and November 2022, before Russia's withdrawal from the west bank of the Dnipro River in Kherson, open-source analysts observed a progressive decrease in Russian military vehicle traffic across the Antonivskiy Bridge and the Nova Kakhovka dam road. The absence of the normal resupply convoys — previously visible in satellite imagery and corroborated by local social media — was one of the earliest indicators that withdrawal was being planned.

Baltic GPS Interference Mapping

Researchers at the Estonian and Finnish aviation authorities documented systematic GPS interference by correlating flight deviations with time and location. By mapping the absence of normal GPS-reliant approaches at airports near the Russian border and Kaliningrad, they effectively reverse-engineered the coverage area and operating schedule of Russian jamming systems. The data showed interference patterns corresponding to Russian military exercises, with jamming active during exercise periods and inactive between them.

Social Media Silence as an Indicator

The principle extends beyond physical data. A sudden decrease in social media posts geolocated to a specific area can indicate a communications blackout, a population displacement, or an internet shutdown. During the early hours of Myanmar's 2021 coup, the drop in social media activity from Naypyidaw was detectable before news organizations reported what was happening. The absence of posts was the signal.

The Analytical Discipline

Reading the absence requires a specific analytical discipline: you must continuously ask "what should be here that isn't?" This is the inverse of the normal analytical process, which focuses on what IS present. It demands knowledge of baselines, patterns, and norms that can only come from sustained monitoring over time.

Platforms like Deep Seer make this possible by aggregating multiple data layers — AIS, ADS-B, traffic feeds, environmental sensors — into a single view where baselines are computed automatically and deviations are flagged. But the technology is the enabler, not the answer. The analytical judgment about what an absence means still requires the human understanding of context, motive, and consequence.

The hole in the map is the signal. The empty space in the data is the story. The vessel that should be there but isn't, the flight that should exist but doesn't, the report that should have been filed but wasn't — these absences are the starting points of the most important investigations.