“Squawking” — Why Transponder Codes Are Important for OSINT
--
“JUMP92 squawking 7214”
or
“MILLER98, squawk 5213, IDENT”
For anyone familiar with crowd-sourced OSINT and conflict monitoring, I’m sure you’ve seen your fair share of accounts of Twitter, Telegram, or Reddit sharing live views of open-source flight radars — coupled with 140 characters of unintelligible jargon intended for those who understand the technical aspects of civil aviation or have some prior experience in the field.
One of the most mystifying, yet worthwhile pieces of public information available on flight radars — including Flightradar24, FlightAware, and ADSBx — is the “squawk.” That four-digit code attached to an aircraft on a radar.
For example:
This Beechcraft 350i is squawking 4401 at Naval Base Coronado in San Diego, California. What does that mean, and why is it useful for us?
It’s a transponder code.
Access to transponder codes allows open-source analysts to make rough “guesstimations” regarding the purpose of flights of interest, the messages exchanged between an aircraft and air traffic control (ATC), and the environment/airspace in which an aircraft is operating in.
What exactly are transponder codes?
Without getting too technical, a “squawk” is a code that an aircraft transmits as a response to an ATC request for identification via a secondary surveillance radar (SSR). The SSR transmits a pulse that an aircraft receives at 1030 MHz and responds with a code at 1090 MHz. SSR systems — in contrast to primary radars — specifically target aircraft with Mode C or Mode S transponders onboard, whereas primary radars pulsate broad electromagnetic waves that illuminate large spaces to get a full scope of airborne craft within a set range.
In other words, SSR systems are used to communicate with specific aircraft — transmitting and receiving four-digit codes that are then relayed to ATC.
Here’s a simple diagram of how the system works:
Here is a straightforward explanation of the differences between SSR and PSR systems:
So, now that the technical stuff is out of the way, what exactly do these four-digit squawk codes mean and why are they useful for open-source analysts?
These “squawks” can mean a great number of things.
In fact, 4096 different things…
And that’s just for the United States. Transponder codes — with the exception of three defined by the ICAO — are unique to each ICAO member state’s aviation administration and defined by their respective air traffic control (ATC) standards. That means — if we were to assume that all 193 ICAO members states have unique transponder code systems — we could be looking at a mind-boggling 800,000+ unique “squawk” codes from around the world…
Hence why its very difficult for analysts, intelligence services, and aviation experts alike to discern the meaning of transponder codes on foreign radars.
Thankfully, for those of us in the United States, there are time-efficient strategies for understanding squawks without having to literally memorize 4096 unique codes while having a detailed spreadsheet with you at all times.
Like, what is this nonsense?
Well, I’m here to help make this process a little easier.
Squawks are codes that work on an octal system, rather than the decimal system that we’re accustomed too. With the lowest digit being 0 and highest being 7, we know that squawks exists in a range of 0000–7777. Thus there are 4096 different combinations that are possible within that range that can be transmitted — and received — by an aircraft with a Mode C or Mode S transponder.
With 4096 different possibilities, I can assure you that the vast majority of transponder codes are general, non-discrete codes simply used to identify an aircraft and communicate with ATC. The vast majority of codes are for non-emergencies and simply used in day-to-day flying — not very useful for conflict monitoring, news monitoring, or open-source analysis.
However, there are three codes standardized by the ICAO that everyone should be familiar with. These codes are the same around the world, no matter what state an aircraft is registered in or airspace it is operating in, and are used to signal international emergencies:
7500: Hijacking (“unlawful interference”)
7600: Radio Failure (“communications failure”)
7700: General Emergency
Another standardized ICAO code, 7000, is the standard code for Visual Flight Rules (VFR) — whereas the United States and Canada use 1200 instead.
Notable examples of the three include:
7500: Used by United Airlines Flight 93 to signal a hijacking during the September 11th attacks, Malaysia Airlines Flight MH128 in 2017, etc.
7600: Used during the Malaysia Airlines Flights MH370 disappearance in 2014 to signal lost communications.
7700: General emergencies onboard an aircraft — ranging from low fuel to a sick passenger — that typically indicates a request for emergency landing. 7700 squawks are relatively common, however rarely indicate an international disaster situation.
In correspondance with ATC, pilots often use the verbal codes Pan-Pan to declare an urgent situation or Mayday to declare a distress situation — in conjunction with a squawk. However, since these codes are broadcasted over radios and not available to us on an open-source ADS-B radar, they are much less useful than the actual squawks themselves and we’re typically only aware of such signals after-the-fact.
It is incredibly important to note that, from my experience, the majority of 7500, 7600, and 7700 codes are (unfortunately) triggered by accident — however, this doesn’t make them any less serious and they still require an urgent response. A notable example is Saudi Airlines Flight SVA872 in 2016, which accidentally squawked the 7600 hijacking code twice and was surrounded by military and law enforcement officials in Manila, Philippines.
In the United States, squawk codes are clearly defined and are very easy to discern their purpose, thanks to an efficient and easy-to-memorize numbering system.
Notable codes include:
1200: The standard code for aircraft operating in Visual Flight Rules (VFR).
1255: Firefighting aircraft on an urgent mission. Notably used during the 2019 California Wildfires.
1277: Aircraft on an urgent search-and-rescue (SAR) mission.
4401–4433, 4466–4467: Special operations.
5100–5300: U.S. Department of Defense aircraft beyond DOD radar coverage.
5000–5057: Used by NORAD designated aircraft.
7601–7607, 7701–7707: Allocated by the FAA for use by all Federal Law Enforcement Agencies.
A full list of non-discrete codes that are delineated by the FAA can be found in a spreadsheet here.
Let’s examine that B350 again that I had mentioned earlier:
This Beechcraft 350i was grounded at Naval Base Coronado (NBC) in San Diego, California. It is squawking 4401 — the “special operations” code that I had listed earlier. In the field (when available on open-source radar), 4401 is often used by aircraft belonging to the United States Naval Special Warfare Command (NSWC) — associated with the Navy SEALs.
Since we know that NSWC is housed at the Naval Amphibious Base Coronado (NAB) — where the SEALs conduct their training — we can make the logical leap to assume that this aircraft is *most likely* part of a Navy SEALs training exercise. Hence why it was grounded at the base in San Diego.
Let’s look at another example:
Here we have a Beechcraft King Air (BE9L) utility turboprop that is operating outside Naval Air Station (NAS) Corpus Christi, Texas.
Here is the flight path:
MNTNA20, along with three other BE9Ls, is squawking 0420. Here are the others:
04XX is not explicitly defined by the FAA as a code indicating a specific purpose. However, if we were to revisit that earlier spreadsheet, we know that the code 0400 is a catch-all code that is reserved by the FAA for use by airport terminals, Naval Air Station (NAS) ATC, “experimental” activities, and training.
Here, we can make the logical connection that these four aircraft operating off the coast in Corpus Christi are *most likely* training aircraft used by the Naval Aviator Training Program where enlisted reserves of the Navy, U.S. Marine Corps, and U.S. Coast Guard conduct training exercises. We can estimate this with a relatively high level of confidence.
Squawk codes are used for a variety of purposes — as I have just explained. The vast majority of these purposes are normal, day-to-day ATC communications that are non-urgent, standard, and used regularly without any issues.
However, there are instances in which squawk codes on open-source radars warrant monitoring based on the context of the situation and their location.
Squawk codes are confusing, but they are vitally important for aviation analysts, open-source analysts, and conflict monitors.
I hope this article illuminates the purposes of such codes — with real-time examples and notable instances in which they are use — and helps you to discern between different codes and understand their purposes when used by ATC and visible on open-source radars.
Alexander Leslie is a foreign policy analyst, freelance journalist, and has an M.A. in Eurasian, Russian, & East European Studies from Georgetown University. His interests include U.S.-Georgia relations, energy politics, and studies in counterterrorism policy.
Contact: aejleslie@gmail.com
Follow me on Twitter!
