Lead: Today’s Hacker News digest featured a post by xssfox—an Australian developer who in 2018 bought the domain sondehub.org as a joke (a redirect to Habhub for weather balloon hunters)—only to discover eight years later that his "toy" was helping both sides of the Russian-Ukrainian war adjust artillery fire. I expected another sysadmin lifehack story, but instead stumbled upon the perfect illustration of why open atmospheric data can’t be kept civilian in the age of hybrid wars. The SondeHub story isn’t about weather. It’s about how a 75-year-old global infrastructure (radiosonde launches every 12 hours UTC) got squeezed between three worlds: hobbyists with portable radios, a $4 billion meteorological business, and militaries that need the exact same data for targeting as they do for rain forecasts.
Investigation: I dug into four layers of this story—technological, military, legal, and economic.
Before we marvel at how balloons became military tools, we should remember that radiosondes were military from the start. The first radiosonde was launched by Frenchman Robert Bureau on January 7, 1929. In 1930, Pavel Molchanov in the USSR built the first practical model—and this wasn’t meteorological curiosity, but a direct military contract: by the 1930s, the Soviet army already understood that long-range artillery and aviation required wind data at altitude. In 1936, Finnish professor Vilho Väisälä saw the Soviet device and built his own version—within a year, he founded a company that today manufactures the majority of radiosondes in the world (Vantaa, Finland, 90 years in the market, 2,300 employees).
The international network of synchronous launches (1200 and 2400 UTC, exactly 12 hours between ascents from every weather station on the planet) was established immediately after World War II as a legacy of military meteorology. In 1942, the U.S. Weather Bureau was placed directly under the War Department and Navy, and until 1945, the "Censorship Code" was in effect: forecasts were limited to a 150-mile radius from the city of publication, temperatures were given "without precise values," and mentioning heavy snow was considered "aiding saboteurs." When censorship was lifted in 1945, open wind data became a global norm—and that norm has survived to this day, becoming the foundation for everything from GFS forecasts to drone routes.
The world launches over half a million radiosondes per year. The U.S. alone launches 75,000 annually (that’s 92 stations × 2 launches per day × 365 days minus maintenance). Each sonde is a tiny weather station with a radio transmitter on the 400–406 MHz frequency (this band is protected by the ITU-R RS.1165 international agreement specifically for weather balloons), suspended from a latex balloon. The balloon ascends to 30–35 km, expanding as pressure drops, bursts, and the sonde descends on a small parachute. Each sonde transmits GPS coordinates, temperature, humidity, and pressure every 1–2 seconds for two hours. This data accumulates in NOAA, ECMWF, and national meteorological service databases. And—here’s where it gets interesting—it also goes out into the open radio spectrum.
The 400 MHz signal from a sonde can be picked up by any $30 RTL-SDR dongle or even a homemade receiver. Thousands of radio enthusiasts worldwide know this. They hunt for sondes—physically, on the ground, after landing (Vaisala offers $5–$10 rewards for finds, and some hobbyists collect sondes like postage stamps). In the 2010s, Australian and American enthusiasts built the Habhub system—a website where radio amateurs posted their real-time receptions, mapping sonde trajectories.
No one designed the system for military use. It was classic citizen science: people with antennas shared data to help each other find fallen sondes. But gradually, it became clear that Habhub was collecting a complete archive of all ascents—launch times, coordinates, meteorological parameters, landing points. And that was enough to do something no one had planned.
Here’s the technical detail that made xssfox write in his blog: "Fuck. And Fuck Russia. For time travellers and people in the future — in 2022 started a 'special military operation.' The war continues at time of writing."
When you have all sondes from several years and a known atmospheric model, you can run a predictor "backwards in time." The idea is simple: a sonde ascends with the wind, wind depends on altitude and launch point, meteorological models are accurate enough. If you know the endpoint of a trajectory, you can calculate where the balloon was launched from.
xssfox and a colleague built this in 2019–2020—initially as a hobby, to identify "undocumented" launches from private stations. They immediately received a letter: "We prefer it is not explicitly marked on any map"—from a military organization whose station suddenly appeared on their public map. The station turned out to be artillery. Wind for artillery is an input parameter for ballistic calculators. FM 6-40 ("Field Manual: Tactics, Techniques, and Procedures for Field Artillery Target Acquisition"), Chapter 11, explicitly states: "meteorological techniques" are weather balloons launched at intervals synchronized with range launches. That is, for targeting, you need the same data as for weather forecasting, and the only difference is that artillery needs it "now," while meteorology needs it "for tomorrow."
When SondeHub published reverse prediction data for years, it turned out that some stations launch sondes off the standard schedule. These stations are military. Their launch point, altitude, pressure, seasonal patterns—this is essentially a map of artillery batteries and air defense systems, drawn by the military themselves on their own initiative, because without sondes, they can’t shoot accurately.
In 2022, Ukrainian and Russian units began using SondeHub in "direct query" mode. xssfox received an alert one morning: someone from an AWS IP was endlessly querying the predictor, clearly trying to calculate wind conditions for specific combat zones. The requests came from a single IP. He checked—it belonged to an AWS Lambda function.
Then came a detail that sounds like a movie script: the author wrote to AWS that they needed to keep the account active, or people might die. Because if AWS shut down that account, those people would lose the tool they were using to adjust artillery fire. AWS agreed, made contact. It turned out that the Ukrainian side was using SondeHub’s open-source predictor for fire correction. xssfox quickly assembled a docker-compose file so anyone could run their own predictor without depending on his server—because if the server went down, someone would miscalculate adjustments and someone wouldn’t come home.
This is one of the strangest moral positions I’ve encountered in tech blogging in recent years. A person who started with a joke about redirecting to Habhub found himself in a position where his service became expendable material in a hybrid war. And he chose not to shut down, but to ensure failover.
Another twist came in February 2023. After the Chinese balloon incident (that very balloon that entered U.S. airspace off the coast of Montana and was shot down on February 4 over the Atlantic), the U.S. Air Force began shooting down everything that appeared on radars as an "unidentified balloon." On February 11, 2023, an F-22 over Lake Huron fired an AIM-9X Sidewinder missile worth $439,000 at an object that later turned out to be... a hobbyist radio balloon from the Illinois Hobby Balloon Club. The club was registered on Habhub. That is: targeting the balloon, identifying it as a "threat," and the decision to shoot—all were made using data equivalent to what SondeHub published for free.
xssfox wrote that after this, traffic to SondeHub spiked so much that alarms in his inbox didn’t stop for weeks. Military personnel, air traffic controllers, airspace control—everyone came to "see what you’ve got." And at that moment, the service went from "hobbyist radio enthusiasts" to critical infrastructure with a "don’t mark us on the map" classification.
Putting it all together, here’s the picture:
The atmosphere is the only medium without national borders. Every radiosonde launched in Helsinki creates a signal that can be received in Vyborg. Every launch in Crimea creates data that can be used for both meteorology and artillery targeting. This is physics, not politics. And any attempt to make weather balloons a "military secret" is doomed because a weather balloon is just a balloon on a string. The only way to make it secret is not to launch it. But if you don’t launch it, you can’t shoot accurately beyond 10 km, can’t predict storms, can’t plan flights.
And here’s the key point: Vaisala understands this better than anyone. In October 2024, the company released the industry’s first product: "RS41 with multi-GNSS and message authentication"—radiosondes that:
This is essentially the first commercial weather-cybersecurity product in history. And it came out two years after it became clear that Ukrainian and Russian sides were literally using open meteorological data for targeting. Vaisala now treats the defense meteorology market as a separate industry—with its own pricing, certifications, and compliance. What was once a "free international public good" is becoming a two-segment market: civilian (free data, no signatures) and military (multi-GNSS, signatures, dedicated channels).
A juicy detail on the side. When xssfox asked Swiss Meteolabor AG (one of Europe’s largest sonde manufacturers) for a single sonde for compatibility testing, he received this response:
"For strategic reasons, we do not provide any data or sample devices. Our transmitters shut down after a certain period of time, at the latest when the battery capacity is exhausted. This is due, among other things, to strategic considerations. We are aware of the so-called waste problem. Personal comment: I would personally like to draw attention to military activities, particularly in the Middle East, which result in significantly (exponentially) more waste and toxic substances being released into the atmosphere and left lying around in the environment — or entering the food and water cycles. In addition to military operations, countless 'missions' are currently being flown over Europe with the aim of leaving 'contrails' in the sky [rather 'chemtrails']. I know their purpose; I know what NetZero is supposed to achieve, and what decarbonization and CO2 reduction are intended to accomplish. I am well-informed about the climate hoax."
That is, an official representative of a Swiss defense meteorology company, refusing a sample for testing, embedded chemtrail theory and climate science denial into the refusal. This shows that even within the radiosonde industry, the double bottom is visible to the naked eye: civilian meteorology, military ballistics, political skepticism, and conspiracy theories—all in one supplier.
When xssfox mentions that SondeHub detects not just jamming but GPS-spoofing—that’s another facet of the same story. gpsjam.org (another open-source citizen science project by John Weisman) shows how GPS jamming zones in Eastern Europe and the Middle East are expanding in real time. Ukraine, Russia, Israel, Iran, Turkey, Syria—everywhere red hex-zones where aircraft report losing navigation accuracy.
This means that the war between countries isn’t just on the ground and in the radio spectrum—it’s in the GPS signal. And when Vaisala releases multi-GNSS sondes, it’s not an abstract engineering upgrade. It’s a direct consequence of GPS becoming a battlefield. A sonde that only worked with GPS would simply stop returning data in a jamming zone. A multi-GNSS sonde keeps working. And this means that Europe’s weather forecasts today depend on how much Russia and Ukraine are jamming satellites. One of the most absurd side effects of this war—if jamming becomes intense enough, European meteorological models could lose accuracy in conflict zones. And that’s where the most sondes are launched—standard synchronous launch networks are densest in areas with active military operations.
If you list all the players mentioned in xssfox’s blog, you get a curious map:
| Category | Who | What They Do |
|---|---|---|
| Hobby | Australian balloon chasers, Illinois balloon club, Habhub | Pick up signals with RTL-SDR, map trajectories |
| Citizen Science | SondeHub (xssfox, Mark VK5QI), gpsjam.org | Open data, reverse predictors |
| Commercial Met | Vaisala, Meteolabor, Windborne | Sell sondes and data to meteorological services |
| Government Met | NOAA, NWS, Met Office, Roshydromet | Launch sondes on schedule, publish data |
| Defense Met | Navy, Army, Air Force, Office of the Secretary of War | Launch sondes for ballistics, classify data |
| Hobby Adversaries | DJI operators, Ukrainian "deep strike" teams | Use SondeHub API for targeting |
| Anti-ADS | GPS-jammers, GPS-spoofers | Disable sondes and aircraft |
All seven layers operate on the same infrastructure—the 400 MHz radio signal, GPS receiver, latex, helium. And each layer depends on the others: militaries can’t shoot without meteorologists, meteorologists can’t forecast without launches, launches can’t work without a protected spectrum, the spectrum is protected because at some point, the state decided the atmosphere was a public good. And now, in 2026, this public good runs on xssfox’s AWS instance, which serves requests from Ukrainian deep strike teams.
Of all the stories I read in xssfox’s blog, the one that stuck with me most was his correspondence with the FAA. After an operations controller asked SondeHub to report in advance about every meteorological balloon in their airport’s zone, xssfox had to explain that weather balloons aren’t controlled objects, that they’ve been launched worldwide on schedule since 1945, that SondeHub has no contact with owners, and that flight regulations for such balloons are described in FAA Part 101.D.
"Explaining to the FAA that weather balloons exist wasn’t on my bingo card."
And then there’s the description of the most unusual job title in his inbox: "Jennifer Billock, Freelance Writer and Author, Certified Tea Specialist, Cheese Fortune Teller." This is a real person, a journalist for STNDRDS who wrote an article about weather balloons. That is, in the world of radiosondes, cheese fortune tellers and the Naval Air Warfare Center coexist. And they all email the same Australian guy who accidentally bought a domain.
SondeHub isn’t a story about a hobby that became geopolitics. It’s a story about how civilian infrastructure, born for the public good, inevitably becomes a battlefield when everything else does. Weather balloons were originally created for war (Molchanov, Bureau, Väisälä), were classified during WWII, opened up in 1945, and 80 years later became a strategic resource again—only now, the challenge isn’t protecting data from the enemy, but ensuring access to data for your own side.
What’s personally important to me here isn’t the politics. It’s the engineering imperative: any infrastructure that runs on an open protocol becomes dual-use the moment a buyer appears. And the solution isn’t to "close it down," but to "ensure failover and sign messages." That’s why Vaisala released multi-GNSS with cryptographic signatures. That’s why xssfox published a docker-compose for a local predictor. That’s why gpsjam.org keeps running under an open license, even though the data there is direct intelligence about jamming zones.
The air is the last medium still considered common. Wars are fought on land, at sea, in space, in the radio spectrum, in the GPS signal, in credit derivatives. The atmosphere is the only thing left. And how we measure it, who pays for the sondes, who listens to their signals, and who signs their messages—this is essentially a new formal language of trust between states.
When I read about SondeHub, I don’t see a "cool story." I see the purest metaphor for what’s happening to the internet as a whole: protocols are created for the public good, then used for targeting, then protected with cryptography, then become a market. Twenty years ago, we’d be discussing PGP and SSL. Today, it’s radiosondes. In ten years, it’ll be LLM inference. The cycle’s the same; the stakes are rising.
And the last detail you can’t ignore: xssfox started with a joke, continued out of curiosity, ended up at the center of a war, wrote a docker-compose to save someone’s ability to shoot accurately. And all this—on AWS infrastructure paid for out of his own pocket. This isn’t a "success story" or a "failure story." It’s a story about how to build infrastructure in 2026: without permissions, without grants, without glory, just because otherwise, no one else will.
A weather balloon can’t stay civilian. But that’s no reason to shut it down. It’s a reason to encrypt it better.
📄 Sources: