1. Collection Basis and Product Scope
This report consolidates automated traffic analysis across
monitored Kaltovian military networks and presents a selection of
intercepted communications assessed as operationally relevant for
current planning requirements. Collection spans the period 01
August to 05 October 2025 across the northern, western, southern,
and Site-7-associated communications channels. Traffic volumetrics
are presented in normalised form; intercepted content is
reproduced in sanitised and paraphrased form to protect collection
sources and methods.
Analysts are reminded that all intercepted content should be
treated as potentially subject to deliberate deception or
selective transmission; cross-reference with HUMINT and IMINT
streams is recommended before operational reliance on any specific
intercept. The traffic volumetric data — which is derived from
metadata analysis rather than content — is assessed as more robust
against deliberate manipulation.
2. Network Traffic — Diurnal Pattern Analysis
Automated volumetric analysis of monitored Kaltovian military
network traffic across the collection period confirms and extends
the findings of the satellite-derived staffing assessment in
SIG-2025-0847. The traffic data provides an independent,
non-imagery-derived corroboration of the diurnal patterns
identified through thermal console-position analysis.
| Period (Local) |
Military net traffic (normalised) |
Southern coastal subnet |
Northern ADSOC subnet |
Site-7 associated traffic |
| 06:00–12:00 |
1.00 (baseline) |
0.18 |
1.00 |
0.45 |
| 12:00–18:00 |
0.96 |
0.15 |
0.98 |
0.51 |
| 18:00–22:00 |
0.62 |
0.11 |
0.60 |
0.38 |
| 22:00–02:00 |
0.37 |
0.08 |
0.35 |
0.22 |
| 02:00–04:00 |
0.20 |
0.06 |
0.19 |
0.14 |
| 04:00–06:00 |
0.28 |
0.07 |
0.27 |
0.18 |
The southern coastal subnet consistently operates at 15 to 20
percent of the total military network volume even during peak
hours, consistent with HUMINT reporting on the sector’s
deprioritised status. The traffic pattern shows no meaningful
diurnal variation on the southern subnet, suggesting that the low
volume reflects a structural condition — minimal staffing and
activity at all hours — rather than a normal night-shift reduction
pattern. This is consistent with source ORION’s description of a
sector operating at around-the-clock minimum capacity.
The 02:00 to 04:00 trough across the northern ADSOC subnet — where
traffic falls to approximately 19% of daytime volume — is
independently corroborated by this data. The trough is narrower
and less pronounced than the 02:30 to 04:30 window identified in
the Site-7 associated traffic (14% of daytime volume), suggesting
that whatever residual activity continues at the ADSOC during the
minimum staffing window, it is more active than the Site-7
installation’s own network activity during the same period.
3. Selected Intercepted Communications — Sanitised Summaries
The following intercepts are reproduced in paraphrased form.
Direct quotation is withheld to protect collection methods.
Analyst commentary follows each item.
Communication between
XXXXXXXXXXXXXXX and southern
coastal logistics officer. Content: logistics officer requests
emergency fuel allocation to support increased patrol schedule.
Request is denied by
XXXXXXXX on grounds that
quarterly fuel allocation for the southern sector has already
been disbursed in full. Logistics officer responds that at
current fuel holdings, the sector cannot sustain more than two
patrols per week.
XXXXXXXX acknowledges and
states that the situation will be reviewed at the next quarterly
allocation cycle. Logistics officer makes a remark —
reconstructed from context — to the effect that the southern
coast “might as well not exist” for the purposes of the defence
ministry’s planning priorities.
Consistent with HUMINT reporting on fuel depot capacity
(approximately 40% of nominal) and with ORION’s characterisation
of the southern sector as institutionally neglected. The
reference to two patrols per week is consistent with the
irregular patrol patterns noted in open-source maritime
monitoring.
Administrative communication between northern command logistics
section and central fuel allocation office. Content:
confirmation of Q3 supplemental fuel allocation transfer to
northern sector depots. Quantity
XXXXXXXX metric tonnes.
Receiving officer notes allocation is “consistent with the
revised priority schedule” and requests confirmation that the
allocation is for permanent reallocation rather than a one-time
supplement. XXXXXXXX confirms
permanent reallocation status. No reference to other sectors.
Routine logistics communication. Confirms that northern sector
is receiving priority fuel allocation under a permanent
reallocation arrangement. Consistent with HUMINT reporting on
the mechanism by which the southern sector’s holdings have been
reduced. No operationally significant new information beyond
corroboration of resource priority pattern.
Automated alert — Level I detection event — generated at 03:02
local time by northern perimeter radar. Alert ticket shows
acknowledgement by duty operator at 03:19, a delay of 17
minutes. Standard operating procedure requires acknowledgement
within 15 minutes. Alert was automatically stood down at 03:17
prior to acknowledgement, as the system’s 15-minute escalation
window expired. Post-event log shows duty operator noting:
“XXXXXXXX” — reconstructed as a
reference to the stood-down alert combined with a brief comment
on shift fatigue.
One of three instances in the collection period of an automated
alert exceeding the acknowledgement threshold and standing down
without human review. All three occurred between 02:30 and 04:15
local time. Consistent with SIG-2025-0847 §4 finding on
acknowledgement delays during the minimum-staffing window.
Internal scheduling communication between
XXXXXXXX and ministerial
office. Content: preparation of the minister’s National Assembly
address scheduled for 02 October, including sequencing of
capability announcements. References to Site-7, with
XXXXXXXX requesting
confirmation of the activation date for inclusion in the
address. Responding party confirms “5 November stands” and notes
the announcement “should emphasise the deterrence significance”
of the date. Remainder of communication addresses unrelated
parliamentary scheduling matters.
Pre-announcement coordination for the Site-7 activation address
subsequently delivered 02 October. Confirms that the 5 November
activation date was established and internally confirmed at
ministerial level prior to the public announcement. No new
content beyond what was subsequently announced publicly.
Routine situation report, western sector command to central
command. Summary: readiness status
XXXXXXXX. Training activity for
the week ending 27 September listed; includes an urban combat
exercise with XXXXXXXX
personnel participation. No anomalous indicators noted.
Logistics situation described as satisfactory. Communication
ends with routine confirmation acknowledgement.
Routine administrative reporting. Western sector communications
follow a regular pattern of weekly situation reports; this
example is representative. Content is consistent with an active,
well-resourced command conducting regular training. No
operational intelligence value beyond pattern confirmation.
Internal communication — partially decrypted — within Defence
Ministry administrative network, following the minister’s
National Assembly address. Content fragment discusses “the
significance of the 5 November date” in the context of
XXXXXXXXXXXXXXXXXXXXXXXX. A
second fragment references “the window before activation” in a
context consistent with internal awareness that the period prior
to Site-7’s activation date carries specific strategic
significance. Full context not recoverable from the partial
decrypt.
Partial intercept of limited standalone value, included for
completeness. The phrase “the window before activation” is noted
but should not be over-interpreted given the incomplete
decryption. It is consistent with the broader picture but does
not add materially to it.
4. Overall SIGINT Assessment
The combined traffic volumetric and intercept picture
corroborates, through an independent collection stream, the
principal findings of SIG-2025-0847 and HUM-2025-0231. The
southern coastal sector operates at minimal network activity at
all hours, consistent with structural under-resourcing rather than
a predictable diurnal cycle. The northern ADSOC shows a pronounced
night-shift traffic trough in the early morning hours, with the
deepest observed point between approximately 02:30 and 04:30,
during which three separate instances of automated alert
non-acknowledgement occurred. Site-7 associated communications
show the deepest proportional trough of any monitored network
during the same period, consistent with a facility in final
pre-activation configuration rather than an operationally staffed
installation.
No collection in the current period provides any indicator of
elevated southern coastal defensive activity, covert mining
programmes, or other enhancements that would contradict the
HUMINT-derived picture. The total absence of southern coastal
communication volume increases is particularly notable: a covert
defensive enhancement programme of any meaningful scale would be
expected to generate logistical and command communications
detectable even against a background of deliberate operational
security measures.