Threat Inteliigence / OSINT / NETSEC / NATSEC

Code name: Reindeer - special Christmas report by

Santa Claus aka Gwiazdor - one of the most famous and mysterious characters in the world. Every year he provides gifts to children around the world, and therefore in one day he must visit, according to various estimates, from 240 to even 600 million homes (depending on what assumptions we make regarding the number of children in the home), delivering over 600,000 tons of gifts. So Santa has to visit more than 20 million children an hour, more than 6,000 a second. Let's not forget about the elves who work hard all year round to cook these hundreds of millions of gifts. All this seems impossible, and yet the effects of his activities are visible every year all over the world. So let's try to find out more about this amazing character.

Fortunately, the most important government institutions are also interested in this topic. Every year, the North American Air and Space Defense Command (NORAD) tracks Santa's flight around the globe, and advanced anti-ballistic defense systems even provide up-to-date information on the amount of gifts already delivered. Here we can take a look at what it looked like a year ago:

And here is Santa, escorted by US air force fighters:

However, this is an observation of the already known effects of Santa Claus' activities, we will try to find out a little more about the infrastructure of his activities here. The seat of Nicholas' operations is known - Rovaniemi, Finland. We will omit here the sometimes repeated inaccurate rumors about the North Pole base, even though Canada tried to appropriate Mikołaj for itself by granting him citizenship on the basis of ownership of the areas near the pole. As we can see, the real North Pole is a water region:

Meanwhile, of course, Santa's sleigh is equipped with skids, not floats, which clearly suggests the arctic purpose of the vehicle - at least in terms of take-off and landing. So let's take a closer look at the headquarters in Finland:

It is worth paying attention to the presence of a nearby airport, potentially used by Santa Claus for taking off and landing sleds. Using Google Earth tools, we can determine the length of the strip:

It is almost 3 kilometers long. We will choose the B-52 strategic bomber as the closest equivalent of a sled to an aircraft, due to its role in delivering a large amount of cargo without landing. According to a 1976 study it requires about 4,500 feet of runway to take off, which is less than a kilometer and a half. So it seems that Santa could successfully use the nearby airport. However, whether Santa will actually start from there, we can only confirm if someone witnesses this unusual take-off or the sleigh has an active ADS-B transponder - We have already talked about flight tracking at So let's try to take a closer look at the infrastructure of Santa's base. The cave, which is the headquarters, is located in the forest near the village:

From the very beginning, we can see that Santa Claus cares about operational safety - Google Street View has not been allowed to enter the cave itself, and its view ends before entering the direct avenue (blue lines):

Considering the need to store 600,000 tons of gifts and factories necessary to produce millions of gifts a day, we can conclude that the whole thing is hidden underground, and a layer of trees masks the actual size of the complex. However, taking into account the distribution of neighboring villages, roads and buildings that require foundations, it can be roughly assumed that the Santa Claus base covers this area of about a quarter of a square kilometer:

To try to determine something more about the activities of Santa on Christmas Eve, we will use Sentinel Hub - a service offering access to satellite images along with searching for them according to a specific date, and analysis through scripts that allow to emphasize the characteristics of the image. In the Sentinel archives we can find photos from last year's Christmas Eve:

Perhaps we will be able to see the operations related to the loading of gifts on the sleigh or the possible transport of the sleigh to the previously discussed airport. The data that we will obtain through the Sentinel Hub will most often come from the so-called Synthetic Aperture Radar (SAR)). This solution is used on satellites which, for technical reasons, cannot carry very large antennas. Therefore, the resolution is obtained by superimposing the data received by the satellite's antenna in motion - successive images are superimposed on each other, thus obtaining a "synthetic" image with a resolution higher than that which could be obtained from a static antenna. We can start with the SAR Urban filter. It is most often used to analyze urban buildings, and it works by highlighting the ranges of waves reflected by urban objects. Taking into account the location of Santa Claus' cave in the forest, perhaps we will be able to find traces of the operation this way:

Unfortunately, while the nearby buildings stand out a lot, not much is going on in the vicinity of the base itself. Perhaps, however, Santa's technology allows him to mask himself from the technology available to us. But let's try to make sure there were no changes. We can compare photos from consecutive days using the timelapse function that can be found in the tray on the right side of the area. Then we have to choose the layer and dates that interest us:

After selecting the option on the bar at the bottom, we can now play the transitions between subsequent views:

Unfortunately, apart from a different number of small artifacts, it is still difficult for us to determine more details: / Sentinel Hub also allows us to enter our own settings for image filtering, including manually entering scripts that regulate the display. We can find a script for each of the satellites available on the Sentinel Hub even here. To get a better look at the surroundings, we will try to use the so-called False Color. When True Color is the reproduction of colors in the way that the human eye perceives them, False Color is the use of the spectrum received by the sensor and appropriate assigning to them specific colors of visible light - so we can, for example: specify that UV radiation should be red, which will of course change the image compared to "normally" seen, but it may allow us to discover additional details. As it follows from script description "It helps in maritime monitoring (ice monitoring, ship monitoring, ...) land monitoring (agricolture, deforestation, ...) and emergency management (flood monitoring, volcano monitoring, ...)." - the reference to deforestation suggests that it will help us track changes in the forest area. And this is what we are observing right now. So we copy the script from his GitHub page:

And paste it in the Custom Script window, after selecting Custom - Create Custom Visualization from the bottom of the filter list:

As we can see, the colors of the presented area have changed significantly. We can now reuse the timelapse function to try to find changes over time:

And, unfortunately, this is also a failure - False Color very well distinguishes between urban buildings and forest areas and water, but we do not see significant changes in the area of our interest.

Therefore, Santa Claus turned out to be a worthy opponent for the OSINT search - it is hard to believe how big an operation he is successfully hiding in such a small area. However, I hope the advice presented here will help with similar investigations 🙂

At the end of this post, I would like to wish all readers healthy, happy and peaceful holidays spent with their loved ones. If you are reading and are interested in the subject of intelligence in the private sector, you probably also see how many disturbing situations are currently taking place in various parts of the globe. However, I hope that this time will allow for a moment of respite, peace and gaining strength for the upcoming challenges.

Leave a Reply

Your email address will not be published. Required fields are marked *